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Independent Orbiter Assessment 
Analysis of the Electrical Power Generation/Power 
Reactant Storage and Distribution Subsystem 


1 . 0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company ( MDAC ) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis ( FMEA ) and Critical Items 
List (CIL). Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206 , Instructions 
for Preparation of FMEA and CIL , 10 October 1986 . The IOA 
approach features a top-down analysis of the hardware to 
determine failure modes, criticality, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA/ CIL documentation. This report documents (Appendix C) the 
independent analysis results corresponding to the Orbiter 
Electrical Power Generation (EPG) /Power Reactants Storage and 
Distribution (PRSD) System hardware. 

The EPG/ PRSD hardware is required for performing critical 
functions of cryogenic hydrogen and oxygen storage and 
distribution to the Fuel Cell Powerplants (FCP) and Atmospheric 
Revitalization Pressure Control Subsystem (ARPCS). Specifically, 
the EPG/PRSD hardware consists of the following: 

o Hydrogen (H2) tanks 

o Oxygen (02) tanks 

o H2 Relief Valve/Filter Packages ( HRVFP ) 

o 02 Relief Valve/Filter Packages (ORVFP) 

o H2 Valve Modules (HVM ) 

o 02 Valve Modules (OVM) 

o 02 and H2 lines, components, and fittings 


The IOA analysis process utilized available EPG/PRSD hardware 
drawings and schematics for defining hardware assemblies, 
components, and hardware items. Each level of hardware was 
evaluated and analyzed for possible failure modes and effects. 
Criticality was assigned based upon the severity of the effect 
for each failure mode. 
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Figure 1 presents a summary of the failure criticalities for each 
of the seven major divisions of the EPG/PRSD. A summary of the 
number of failure modes, by criticality, is also presented below 
with Hardware (HW) criticality first and Functional (F) 
criticality second. 


I Summary of IOA Failure Modes By Criticality (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Number : 

38 

38 


31 

4 

51 

162 


^ — ^ 


For each failure mode identified, the criticality and redundancy 
screens were examined to identify critical items. A summary of 
Potential Critical Items (PCIs) is presented as follows: 


! Summary of IOA Potential Critical Items (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

Number : 

38 

38 

- 

6 

- 

82 
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Figure 1 - EPG/PRSD OVERVIEW ANALYSIS SUMMARY 


EPG/PRSD OVERVIEW ANALYSIS SUMMARY 


EPG/PRSD ANALYSIS SUMMARY 
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02 VALVE MODULES 


CRIT. 

#FM #PCI 

CRIT. #FM # PCI 

1/1 
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10 
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2/1R 
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16 
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H2 TANKS 



CRIT. 

#FM 

#PCI 

CRIT. 

#FM 

#PCI 

1/1 

6 

6 

3/2R 

0 

0 

2/1 R 

1 

1 
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02 RELIEF VALVE/FILTER PACKAGES 

CRIT. #FM 

#PCI CRIT. #FM #PCI 

1/1 3 

3 3/2R 0 0 

2/1R 3 

33/300 

3/1R 4 

0 



H2 VALVE MODULES 
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2.0 INTRODUCTION 


2 . 1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS). The NSTS Office has 
undertaken the task of reevaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing an independent assessment 
of the Orbiter FMEA/CIL for completeness and technical accuracy. 


2.2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases . 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 


Step 1.0 Subsystem familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2.3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3.1 Construct matrix of failure modes 

3.2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4.2 Review in-house 

4.3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 EPG/PRSD Ground Rules and Assumptions 

The EPG/PRSD ground rules and assumptions used in the IOA are 
defined in Appendix B. 
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3.0 SUBSYSTEM DESCRIPTION 


3.1 Design and Function 

The EPG/PRSD consists of hardware that is required for cryogenic 
hydrogen and oxygen storage and distribution to the FCP and 
ARPCS . Reference Figures 2 and 3. The EPG/PRSD consists of the 
.following divisions: 

1. The Hydrogen (H2) tanks can number from 2 to 5 (each 
tank having a 1:1 correspondence to an oxygen tank). 

The H2 reactant is stored in the tank at an initial 
temperature of -424 degrees F. Each tank consists of 
an A and B heater, heater controller pressure sensor, 
tank pressure sensor, fluid temperature sensor, 
quantity sensor, heater assembly temperature sensor, 
relief valve and port, and fill and vent Quick 
Disconnects (QD) with caps. The reactant flow to the 
fuel cells is controlled by operation of the heaters 
which in turn are controlled by the heater controller. 
Reference Figure 4. 

2. There is a H2 Relief Valve/Filter Package for each H2 
tank. All HRVFP's have a filter, and the ones for 
tanks 1 and 2 contain a manifold relief valve, while 
those for tanks 3 and 4 contain a check valve. The 
filters extract reactant impurities which could degrade 
fuel cell performance. The manifold relief valves 
relieve excess manifold pressure by allowing reactants 
to flow into tanks 1 or 2. The check valves prevent 
reactants from flowing back into the tank in the event 
it is at a low pressure. Tanks 4 and 5 share a check 
valve. Reference Figure 5. 

3 . There are 2 H2 Valve Modules . Both HVMs contain a 
check valve (one for tank l, one for tank 2), a 
manifold shutoff valve and its position indicator, and 
a manifold pressure sensor. HVM 1 contains a 
horizontal drain QD and cap. HVM 1 also contains one 
fuel cell reactant supply valve and its position 
sensor, while HVM 2 contains two of each. HVM 2 also 
contains a Ground Support Equipment (GSE) valve and GSE 
Time Zero (T-O) fill QD. The manifold valves can be 
used to isolate manifold I from 2. The GSE valve and 
fill QD allow the fuel cells to run on ground reactants 
before launch. Reference Figure 6. 
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4. The Oxygen (02) tanks flown on a mission can number 
from 2 to 5. The 02 reactant is stored in the tank at 
an initial temperature of -300 degrees F. Each tank 
contains heaters labeled Al, A2, B1 and B2, with one 
heater assembly consisting of Al and B1 and the other 
containing A2 and B2. The tanks also consist of a 
temperature sensor for each heater assembly, fluid 
temperature sensor, quantity sensor, pressure sensor, 
heater controller pressure sensor, relief valve and 
port, fill QD and cap, and vent QD and cap. In a five 
tank configuration, the B heater in tanks 4 and 5 are 
not operational. Reference Figure 7. 

5 . There is an 02 Relief Valve/Filter Package for each 02 
tank. All ORVFP's have a filter, plus the ones for 
tanks 1 and 2 contain a manifold relief valve, while 
those for tanks 3 and 4 contain a check valve. 

Reference Figure 8. 

6. There are 2 02 Valve Modules. Both OVM's contain a 
check valve (one for tank 1, one for tank 2), a 
manifold shutoff valve and its position indicator, a 
manifold pressure sensor, and an ECLSS system supply 
valve and its position sensor. HVM 1 contains one fuel 
cell reactant supply valve and its position sensor, 
while HVM 2 contains two of each. HVM 1 contains a GSE 
valve and GSE fill T-0 QD. HVM 2 contains a horizontal 
drain QD and cap. Reference Figure 9. 

7. The 02 and H2 lines, components, and fittings made up 

a separate category outside of the six major divisions. 
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3 . 2 Interfaces and Locations 


The EPG/PRSD interfaces directly with the FCP and ARPCS. 

Hydrogen and Oxygen are supplied to the FCP's while oxygen is 
supplied to the ARPCS. The PRSD subsystem components are 
installed in the mid-fuselage of the Orbiter beneath the payload 
bay liner. The H2 and 02 tanks are arranged on both sides of the 
mid-fuselage in a random type of order. Reference Figure 10. 

The 02 and H2 relief and drain ports are located on both sides of 
the Orbiter fuselage. Reference Figures 11 and 12. 


3 . 3 Hierarchy 

Figures 2 and 3 illustrate the hierarchy of the EPG and PRSD 
systems, respectively. The PRSD subsystems are depicted in 
Figures 4 through 9 . 
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Figure 2 - EPG SUBSYSTEM OVERVIEW 
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Figure 6 - PRSD H2 VALVE MODULES 
















Figure 7 - PRSD OXYGEN TANKS 



- - OPTIONAL TANKS 






















Figure 8 - PRSD 02 RELIEF VALVE/FILTER PACKAGES 
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Figure 9 - PRSD 02 VALVE MODULES 
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Figure 10 - PRSD COMPONENT LOCATIONS 
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4.0 ANALYSIS RESULTS 

Detailed analysis results for each of the identified failure 
modes are presented in Appendix C. Table I presents a summary of 
the failure criticalities for each of the seven major sub- 
divisions of the EPG/PRSD. Further discussion of each of these 
subdivisions and the applicable failure modes is provided in 
subsequent paragraphs . 


+ + 


TABLE I Summary of IOA Failure 

Modes and Criticalities 

Criticality : 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

H2 Tanks 

6 

1 

- 

8 

- 

13 

28 

HRVFP 

3 

3 

- 

4 

- 

- 

10 

HVM 

8 

12 

- 

4 

2 

10 

36 

02 Tanks 

6 

1 

- 

7 

- 

16 

30 

ORVFP 

3 

3 

- 

4 

- 

- 

10 

OVM 

10 

16 

- 

4 

2 

12 

44 

02 & H2 Lines 

2 

2 

- 

- 

- 

- 

4 

TOTAL 

+ 

38 

38 

- 

31 

4 

51 

162 

+ 


Of the 162 failure modes analyzed, 82 were determined to be PCIs. 
A summary of the PCIs is presented in Table II. Appendix D 
presents a cross reference between each PCI and a specific work 
sheet in Appendix C. 
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H • + 

| TABLE II Summary of IOA Potential Critical Items | 


Criticality : 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

H2 Tanks 

6 

1 

- 

3 

- 

10 

HRVFP 

3 

3 

- 

- 

- 

6 

HVM 

8 

12 

- 

- 

- 

20 

02 Tanks 

6 

1 

- 

3 

- 

10 

ORVFP 

3 

3 

- 

- 

- 

6 

OVM 

10 

16 

- 

- 

- 

26 

02 & H2 Lines 

2 

2 

- 

- 

- 

4 

TOTAL 

38 

38 

- 

6 

- 

82 


4.1 Analysis Results - Hydrogen Tanks 

Failures related to the H2 tanks and outer components were 
analyzed. Critical failures were due to external leaks, 
ruptures, loss of annulus vacuum, mechanical failures of valves, 
and restricted flow out of relief ports. Noncritical failures 
involved faulty tank pressure outputs and the inability of QDs to 
mate/demate. 

Components which make up the tanks were individually analyzed. 
Critical failures involved faulty heater controller output and 
malfunctioning heater elements. Noncritical failures involved 
faulty heater temperature, tank quantity, and fluid temperature 
outputs. Ten failures were identified to be PCIs. 


4.2 Analysis Results - HRVFP 

Critical failures of components involved clogged filters, 
mechanical failures of valves, and external leakage. There were 
no noncritical failures. Six failures were identified to be 
PCIs. 
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4.3 Analysis Results - HVM 

Critical failures of components involved mechanical and 
electrical failures of valves, and external leakage. Noncritical 
failures involved the inability of QDs to mate/demate, faulty 
output of pressure and valve position sensors, and electrical 
failures of valves. Twenty failures were identified to be PCIs. 


4.4 Analysis Results - Oxygen Tanks 

Failures related to the 02 tanks and outer components were 
analyzed. Critical failures were due to external leaks, 
ruptures, loss of annulus vacuum, mechanical failures of valves, 
and restricted flow out of the relief port. Noncritical failures 
involved faulty tank pressure outputs and the inability of QDs to 
mate/demate. 

Components which make up the tanks were individually analyzed. 
Critical failures involved faulty heater controller output and 
malfunctioning heater elements. Noncritical failures involved 
faulty heater temperature, tank quantity, and fluid temperature 
outputs. Ten failures were identified to be PCIs. 


4.5 Analysis Results - ORVFP 

Critical failures of components involved clogged filters, 
mechanical failures of valves, and external leakage. There were 
no noncritical failures. Six failures were identified to be 
PCIs. 


4.6 Analysis Results - OVM 

Critical failures of components involved mechanical and 
electrical valve failures, and external leakage. Noncritical 
failures involved the ability of QDs to mate/demate, faulty 
output of pressure and valve position sensors, and electrical 
failures of valves. Twenty-six failures were identified to be 
PCIs. 

4.7 Analysis Results - 02 and H2 Lines, Components and Fittings 

Critical failures involved external leakage and restricted flow. 
There were no noncritical failures. Four failures were 
identified to be PCIs. 
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Valves Sc Components, RH Side, Assy, of. Rev. E, 4 
86 . 

n. VO70-454898 , Electrical Power Substation, LH 
Installation, Xo693 to Xo919, Rev. B, 12-85. 

o. V070-454899, Electrical Power Subsystem 
Instl-RH Side, Xo693 to Xo 919, Rev. B, 12-10-82. 

p. VS70-458678, PRSD 102 Sc Subs, Schematic, Rev. A, 
11-7-79. 

q. V525-454158, Panel - Tank Set 4, H2 Pressuure 
Relief, Electrical Power Subsystem, Assy, of. Rev 
C, 7-9-84. 

r. V525-454161, Panel - Tank Set 4, 02 Pressure 
Relief, Electrical Power Subsystem, Assy, of. Rev 
E, 7-6-84. 

s. V544-454137, Panel - Tank Set 3, 02 Pressure 
Relief, Electrical Power Subsystem, Assy, of. Rev 

A, 7-29-80. 

t. V544-454155, Panel - Tank Set 3, H2 Pressure 
Relief, Electrical Power Subsystem, Assy, of. Rev 

B, 7-9-84. 
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APPENDIX A 
ACRONYMS 


AOA 

ARPCS 

Assy 

ATO 

CIL 

CRIT 

CRYO 

C&W 

ECLSS 

EGIL 

EPG 

EPS 

F 

FCP 

FMEA 

GFE 

GSE 

HR 

HRVFP 

H2 

HVM 

HW 

IOA 

JSC 

LB 

LH 

MDAC 

MECO 

MPS 

NASA 

NSTS 

NA 

OMRSD 

OMS 

ORVFP 

02 

OVM 

PCI 

PLS 

PRCB 

PRSD 

psi 

psig 

QD 

Rev 

RH 


Abort Once Around 

Atmospheric Revitalization Pressure Control Subsystem 

Assembly 

Abort To Orbit 

Critical Items List 

Criticality 

Cryogenic 

Caution and Warning System 

Environmental Control and Life Support System 
Electrical, General Instrumentation, and Lighting 
Engineer 

Electrical Power Generation 
Electrical Power System 
Functional 

Fuel Cell Powerplant 

Failure Mode and Effect Analysis 

Government Furnished Equipment 

Ground Support Equipment 

Hour 

Hydrogen Relief Valve/Filter Package 
Hydrogen 

Hydrogen Valve Module 
Hardware 

Independent Orbiter Assessment 
Lyndon B. Johnson Space Center 
Pound 
Left Hand 

McDonnell Douglas Astronautics Company 

Main Engine Cutoff 

Main Propulsion Subsystem 

National Aeronautics and Space Administration 
National Space Transportation System 
Not Applicable 

Operations and Maintenance Requirements and 
Specification Document 
Orbital Maneuvering Subsystem 
Oxygen Relief Valve/Filter Package 
Oxygen 

Oxygen Valve Module 

Potential Critical Item 

Primary Landing Site 

Program Requirements Control Board 

Power Reactant Storage and Distribution 

Pounds Per Square Inch 

Pounds Per Square Inch Gauge 

Quick Disconnect 

Revision 

Right Hand 


A-l 



RI 

- 

Rockwell International 

i 

RTLS 

- 

Return to Landing Site 

k 

STS 

- 

Space Transportation System 


TAL 

- 

Transatlantic Abort Landing 

l 

T-0 

- 

Time Zero 

1 

Xo 

- 

X Axis of Orbiter 
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APPENDIX B 


DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206 , Instructions For Preparation 
of FMEA/CIL , 10 October 1986 , were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS : 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post- flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATQ - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

CREDIBLE ( CAUSE ) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - ma-jor sub-mode of software operational seauence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
( PASS ) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/objective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS : 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/ SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B . 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206 , Instructions for 
Preparation of FMEA/CIL, 10 October 1986 , was employed with the 
following amplifications and additions. 


1 . The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
( FSSRs ) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3 . Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6. All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs , and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7 . Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required . 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8 . The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables, and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP), pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 
EPG/PRSD - Specific Ground Rules and Assumptions 


Component age life will not be considered in the analysis. 

RATIONALE: Component age life analysis is beyond the 

scope of this task. 

Cryogenic system pressure to the fuel cell will be assumed 
lost if unable to maintain minimum supply conditions of 100 
PSI for H2 and/or 02 tanks. 

RATIONALE: Minimum requirements definition. Flight 

rule definition. 

An 02 cryo tank will be assumed lost if both of its heaters 
fail to function (i.e., neither heater will function with 
the delta current sensors enabled). 

RATIONALE: Systems failure definition. Flight rule 

definition. 

An -H2 cryo tank will be assumed lost if neither of its 
heaters will function. 

RATIONALE: Systems failure definition. Flight rule 

definition. 

An impending loss of all cryo 02 or all cryo H2 tanks will 
be cause to exercise the highest-priority abort mode the 
loss/leak will allow. 

RATIONALE: Flight rule definition. 

Continue nominal ascent if 2/3/4 02 (H2) tanks fail when 
flying 3/4/5. 

Enter next PLS daily go/no-go if two 02 (H2) tanks fail 
during lift-off and on-orbit. 

RATIONALE: Flight rules go/no-go criteria. 

Ascent abort decision will be needed for any EPG/PRSD/FCP 
problems that will not support four hours on-orbit plus 
entry time. 

RATIONALE: Flight operations rules. 



8. A fuel cell will be considered failed if the following 
conditions exist. 

a. An abnormal or unexplained voltage versus current 
performance loss of ,>0.5 volts for a single FC based on 
predicted performance data. 

b. Coolant pump or H2 pump/H20 separator is lost. 

c. Fuel cell stack-coolant temperature >255 degrees 
(242.5) degrees F or <175 degrees (182.5) degrees F. 

d. Coolant pressure >75 (71.4) PSIA and increasing. 

e. Fuel cell unable to discharge water to the ECLSS H20 
storage tanks or overboard via the fuel cell H20 
relief system. 

f. Local KOH concentration >48 percent (45 percent) dry or 
<24 percent (29 percent) wet as indicated by fuel cell 
stack-coolant temperature, condenser exit temperature, 
and current relationship. 

g. Fuel cell reactant valve fails closed. 

h. Cannot be connected to a main bus. 

i. Fuel cell H20 pH high confirmed. 

j . Fuel cell 02 reaction chambers cannot be purged . 

k. Fuel cell end-cell heater failing on. 

l. Fuel cell substack delta volts >150 millivolts and 
increasing. 

RATIONALE: Systems failure definition. 

9 . Loss of one fuel cell is considered cause for priority 
flight and abort decision. 

RATIONALE: Mission flight rule definition. 

10. Loss of two fuel cells is considered cause for abort 
mission. 

RATIONALE: Contingency action summary. Flight Rule 

definition. 

11. Loss of three fuel cells is considered loss of life/vehicle 
in all mission phases. 

RATIONALE: Flight rule definition. 
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12. Loss of two fuel cells in the first stage of ascent is 
considered loss of life/vehicle. 

RATIONALE: SRB loads are too high for one fuel cell to 

support. Voltage may go <25v which will 
shut down the GPCs . 

13. Although the ECLSS product-water storage is a separate 
system from EPG, it will be considered as a failable 
redundant product-water relief line for purposes of the EPG 
functional criticality scenarios. 

RATIONALE: This assumption violates general ground 

rule 3. 1.1. 6 but is essential for 
evaluating failures associated with the 
water relief line. 

14. Filter failure will only be considered in the case of total 
flow blockage. Cases of improper/insufficient filtering 
will not be considered except where obvious. 

RATIONALE: The effect of 'poor' filter performance on 

downstream components is beyond the scope 
of our efforts. 

15. The start/sustaining heater on the left-hand FCP (FCP #1) is 
assumed to be disconnected. Thus, this FCP cannot be 
maintained operational at no-load, and will be considered 
shutdown if the load cannot be maintained at greater than 2 
KW.' 

RATIONALE: Load needed to maintain operating 

temperature. RH FCP uses sustaining heater 
to maintain temperatures at no-load. 

16. For all "failed open" failure modes for valves which are 
normally open, redundancy screen B will be assumed failed. 

RATIONALE: The failure is not detectable until the valve 

is required to be closed. 

17. Five 02 and H2 tanks are being used as the baseline 
configuration under study. 

RATIONALE: The configuration for all redundant components 

is being considered for this analysis. 

18. Inadvertant Fuel Cell shutdown during RTLS and TAL abort is 
considered loss of crew/vehicle. 

RATIONALE: Loss of FCP 1/Bus A is loss of OMS Engine 

Purge Capability (required for TAL) and Aft 
Compartment MPS Helium Purge Capability 
(required for RTLS and TAL). 
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APPENDIX C 
DETAILED ANALYSIS 


This section contains the IOA analysis worksheets generated 
during the analysis of this subsystem. The information on these 
worksheets is intentionally similar to the NASA FMEAs. Each of 
these sheets identifies the hardware item being analyzed, and 
parent assembly, as well as the function. For each failure mode, 
the possible causes are outlined, and the assessed hardware and 
functional criticality for each mission phase is listed, as 
described in the NSTS 22206, Instructions for Preparation of FMEA 
and CIL, 10 October 1986 . Finally, effects are entered at the 
bottom of each sheet, and the worst case criticality is entered 
at the top. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 » Loss of life or vehicle 

2 = Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 - All others 

Functional Criticalities: 

1R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 

Redundancy Screen A: 

1 = Is Checked Out PreF light 

2 = Is Capable of Check Out PreFlight 

3 = Not Capable of Check Out PreFlight 
NA = Not Applicable 

Redundancy Screens B and C: 

P = Passed Screen 
F = Failed Screen 
NA = Not Applicable 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/04/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 

FLIGHT: 

3/1R 

MDAC ID: 

200 

ABORT: 

3/1R 

ITEM: 
QD'S (5) 

H2 (PRE-FLIGHT) 

FILL QUICK DISCONNECT (4) 

& VENT 


FAILURE MODE: EXTERNAL LEAKAGE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FU* 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/XR 

TAL: 

3/XR 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/XR 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0210 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE s 

EACH TANK HAS FILL AND VENT QD'S, WITH THE EXCEPTION OF TANKS 4 
AND 5 WHICH SHARE A FILL QD. ALL QD'S ARE ALSO CAPPED FOR 
ADDITIONAL REDUNDANCY. FAILURE OF A QD ALONE IS NOT DETECTABLE. 
BOTH CAP AND QD HAVE TO LEAK FOR A TANK LEAK TO OCCUR. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

201 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


H2 (PRE-FLIGHT) FILL QUICK DISCONNECT (4) & VENT 


ITEM: 

QD»S (5) 

FAILURE MODE: INABILITY TO MATE/DEMATE 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

HYDROGEN STORAGE 

4) 

H2 TANKS 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 3/3 


REDUNDANCY SCREENS: 

A [NA ] B 

[NA ] 

C [NA ] 

LOCATION: MID FUSELAGE 



PART NUMBER: MC276 

-0010-0210 



CAUSES: CORROSION, 

BINDING, DEBRIS 



EFFECTS/RATIONALE : 





THE MISSION COULD BE DELAYED IF THE TANKS CANNOT BE FILLED OR THE 
QD CANNOT BE RELEASED. THE FILL QD ALSO FUNCTIONS AS A VERTICAL 
DRAIN AT PAD. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

202 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 (PRE-FLIGHT) FILL AND VENT QD CAPS (9) 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

HYDROGEN STORAGE 

4) 

H2 TANKS 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/1R 

TAL: 

ONORBIT: 

3/1R 

AO A: 

DEORBIT: 

3/1R 

ATO: 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: A [ 1 ] B [ F ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0260 


HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 


c [ p ] 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE : 

EACH TANK HAS ITS OWN VENT QD CAP AND FILL QD CAP, EXCEPT TANKS 4 
AND 5 WHICH SHARE A FILL QD CAP. THE QD’S THEMSELVES ARE A LEVEL 
OF REDUNDANCY TO STOP LEAKS. BOTH CAP AND QD HAVE TO LEAK FOR A 
TANK LEAK TO OCCUR. FAILURE OF THE CAP ALONE IS NOT 
DETECTABLE . 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 11/04/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/3 

MDAC ID: 203 ABORT: 3/3 

ITEM: H2 TANK PRESSURE SENSOR (5) 

FAILURE MODE: FULL OUTPUT 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0185-003 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

THESE PRESSURE SENSORS HAVE NO EFFECT ON OTHER COMPONENTS; THEY 
ONLY DRIVE GAUGES. FULL OUTPUT WOULD CAUSE THE CREW TO TURN OFF 
THE HEATERS. THE CREW WOULD CHECK RELIEF VALVE CRACK PRESSURE, 
AND QUANTITY AND TEMPERATURE SENSORS TO SEE IF THE PRESSURE 
SENSOR WAS ACCURATE. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

204 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK PRESSURE SENSOR (5) 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/ SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0185-003 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE THE CREW TO TURN THE HEATERS ON. THE 
CREW WOULD CHECK THE TEMPERATURE AND QUANTITY SENSORS TO SEE IF 
THE PRESSURE READING WAS ACCURATE. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

205 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK PRESSURE SENSOR (5) 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FU 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0185-003 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

AN INACCURATE READING MAY CAUSE THE CREW TO MANUALLY OPERATE THE 
HEATERS, TO KEEP THE PRESSURE READING WITHIN TOLERANCES. THE 
CREW COULD USE THE TEMPERATURE AND QUANTITY SENSORS TO SEE IF THE 
PRESSURE READING WAS ACCURATE. A SMALL ERROR WILL NOT CAUSE 
ANY PROBLEMS. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: EPG 

MDAC ID: 206 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/1R 

3/1R 


ITEM: H2 TANK HEATER CONTROLLER PRESSURE 

SENSOR/TRANS DUCER ( 4 ) 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M, HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

HYDROGEN STORAGE 

4) 

H2 TANKS 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ p 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0185-033 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

FULL OUTPUT WOULD CAUSE THE HEATERS NOT TO COME ON IN THE 
AUTOMATIC MODE. THE PRESSURE WOULD HAVE TO DROP TO BELOW 10 0 PS I 
BEFORE THE TANK IS CONSIDERED LOST, WHICH WOULD HAPPEN AFTER OMS 
2. THE CREW COULD CHECK THE TANK PRESSURE AND TEMPERATURE 
SENSORS TO FIND THE PROBLEM. THE CREW ACTIVATES TANK 1 AND 2 A 
HEATERS AFTER OMS1. THIS IS 3/1R BECAUSE THE TANK RELIEF VALVES 
STUCK OPEN COULD CAUSE LOSS OF PRESSURE EARLY. THIS IS 
DETECTABLE FROM THE TANK PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C ~8 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: EPG 

MDAC ID: 207 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 TANK HEATER CONTROLLER PRESSURE 

SENSOR/TRANSDUCER (4) 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

HYDROGEN STORAGE 

4) 

H2 TANKS 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/1R 

RTLS 

LIFTOFF: 

3/1R 

TAL: 

ONORBIT: 

1/1 

AO A: 

DEORBIT: 

1/1 

ATO: 

LANDING/SAFING: 

1/1 



HDW/FUNC 

3/1R 

3/1R 

3/1R 

1/1 


REDUNDANCY SCREENS: A [ 1 ] B[P] C[P] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC4 4 9 -018 5 -03 3 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 


EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE THE HEATERS TO BE ON ALWAYS IN THE 
AUTOMATIC MODE. THE RELIEF VALVE WOULD VENT H2 AND DEPLETE IT- 
RELIEF VALVE FLOW RATE AT FULL FLOW PRESSURE IS 9 7 LB/HR WHILE 
TANK QUANTITY IS 9 2.0 LB. 

ALSO, THE TANK COULD RUPTURE STARTING 35 HOURS AFTER THE TANK 
RESIDUAL LEVEL IS REACHED AND THE HEATERS ARE STILL ON, THUS 1/1. 
THIS IS DETECTABLE FROM THE TANK PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-9 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: EPG 

MDAC ID: 208 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 TANK HEATER CONTROLLER PRESSURE 

SENSOR/TRANS DUCER ( 4 ) 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

EPG 

2 ) 

PRSD 

3 ) 

HYDROGEN STORAGE 

4 ) 

H2 TANKS 

5 ) 


6 ) 


7 ) 


8 ) 


9 ) 



FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/ SAFING: 


CRITICALITIES 


HDW/FUNC 

ABORT 

3/1R 

RTLS 

3/1R 

TAL: 

1/1 

AO A: 

1/1 

ATO: 

1/1 



REDUNDANCY SCREENS: A [ 1 ] B [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-QX85-033 


HDW/FUNC 

3/1R 

3/1R 

3/1R 

1/1 


c [ p ] 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 


EFFECTS/RATIONALE : 

THIS FAILURE DEPENDS ON THE DEGREE OF BEING OUT OF TOLERANCE- 
WORST CASE IS THE UNION OF ZERO AND FULL OUTPUT. THIS COULD 
CAUSE THE HEATERS TO OPERATE ERRATICALLY. THIS IS DETECTABLE 
FROM THE TANK PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-10 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

209 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: H2 TANK HEATER ELEMENT A (5), H2 TANK HEATER 

ELEMENT B (5) 

FAILURE MODE: FAILS ON 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/1R 

RTLS 

LIFTOFF: 

3/1R 

TAL: 

ONORBIT: 

1/1 

AO A: 

DEORBIT: 

1/1 

ATO: 

LANDING/ SAFING: 

1/1 



HDW/FUNC 

3/1R 

3/1R 

3/1R 

1/1 


REDUNDANCY SCREENS: A [ 1 ] B[P] C[P] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, MECHANICAL SHOCK, ELECTRICAL FAILURE 


EFFECTS/RATIONALE : 

EACH TANK HAS AN A AND B 105 WATT HEATER ELEMENT. THIS IS 
CRITICALITY 3/1R BECAUSE THE RELIEF VALVE WOULD VENT THE 
RESULTANT EXCESSIVE PRESSURE IN THE TANK AND DEPLETE THE H2. THE 
RELIEF VALVE FLOW RATE AT FULL FLOW PRESSURE IS 9 7 LB/HR, WHILE 
THE TANK QUANTITY IS 92.0 LB. THE TANK COULD RUPTURE STARTING 35 
HOURS AFTER THE TANK RESIDUAL LEVEL IS REACHED, RESULTING IN 
CRITICALITY 1/1. THIS IS DETECTABLE FROM TEMPERATURE AND 
PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-ll 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 

ITEM: 


11/04/86 

EPG 

210 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ELEMENT B (5) 

FAILURE MODE: FAILS OFF 


H2 TANK HEATER ELEMENT A (5) , H2 TANK HEATER 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, MECHANICAL SHOCK, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

WHEN THE PRESSURE FALLS BELOW 100 PSI, THE TANK IS CONSIDERED 
LOST. THIS WILL ALLOW COMPLETION OF ALL ABORTS AND ASCENTS SINCE 
THE EFFECT WOULD NOT OCCUR UNTIL AFTER OMS 2. THE CREW COULD 
DETECT THE PROBLEM FROM TEMPERATURE, QUANTITY, AND PRESSURE 
SENSORS. HOWEVER, THE CRITICALITY IS 3/1R IF A COMBINATION OF 
TANK RELIEF VALVES AND MANIFOLD RELIEF VALVES FAIL OPEN. 


REFERENCES : 


REPORT DATE 12/03/86 


C-12 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

211 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: H2 TANK RELIEF VALVE (5) -RV030,RV040,RV500,RV560 

FAILURE MODE: FAILED OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c C P 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0402 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

EARLY DEPLETION OF H2 REACTANT WILL CAUSE FUEL CELL SHUTDOWN, AND 
ALSO REDUCE TANK PRESSURE. IF SOME TANK'S CHECK VALVE FAILED 
OPEN, THIS COULD LOSE ALL REACTANT, THUS RESULTING IN CRITICALITY 
2/1R. THIS FAILURE IS DETECTABLE OVER A PERIOD OF TIME 
FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-13 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

212 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 TANK RELIEF VALVE (5) -RV030,RV040,RV500,RV560 

FAILURE MODE: FAILED CLOSED 


f 

iv 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 




.. 

2) 

PRSD 





3) 

HYDROGEN STORAGE 





4) 

H2 TANKS 




f 

5) 





it' 

r. 

6) 






7) 





r 

8) 





i'; 

\} 

8 ) 








CRITICALITIES 


I 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 



PRELAUNCH: 

3/1R 

RTLS: 

3/1R 



LIFTOFF: 

3/1R 

TAL: 

3/1R 

l 


ONORBIT: 

3/1R 

AOA: 

3/1R 



DEORBIT: 

3/1R 

ATO: 

3/1R 



LANDING/SAFING: 

3/1R 



'f; 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 

1 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0402 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

IF THE TANK PRESSURE GETS TOO HIGH, THE TANK COULD RUPTURE, 
CAUSING LOSS OF REACTANT, FUEL CELL SHUTDOWN, AND LOSS OF THE 
ORBITER. THE CRITICALITY IS 3/1R IF A TANK HEATER FAILS ON AND 
ALL TANK RELIEF VALVES FAIL CLOSED. 


REFERENCES : 


REPORT DATE 12/03/86 


C~14 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

213 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: H2 TANK RELIEF VALVE (5) -RV030,RV040,RV500,RV560 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


EPG 

PRSD 

HYDROGEN 
H2 TANKS 


STORAGE 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0402 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

REACTANT LEAKING UNDER THE PAYLOAD BAY LINER COULD RESULT IN THE 
EARLY DEPLETION OF H2 REACTANT, PLUS A POSSIBLE EXPLOSION. THE 
LEAK IS DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE QUANTITY 
CHARTS. 


REFERENCES : 


REPORT DATE 12/04/86 BTK 


C-15 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

11/04/86 

HIGHEST CRITICALITY 

HDW/FUNC 

i 

SUBSYSTEM: 

EPG 

FLIGHT: 

3/1R 


MDAC ID: 

214 

ABORT: 

3/1R 

1 

ITEM: 

H2 RELIEF PORT 1 (1) 



i 


FAILURE MODE: RESTRICTED FLOW 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6 ) 

7) 

3) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/1R 



REDUNDANCY SCREENS: 

A [ i ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 40V45VP035 


CAUSES: BLOCKAGE# CONTAMINATION, DEBRIS 

EFFECTS/RATIONALE : 

H2 RELIEF PORT 1 VENTS H2 FROM TANKS 1, 2# AND 4 RELIEF VALVES. 

IF RESTRICTED, IT WOULD NOT RELIEVE OVERPRESSURIZATION AND A TANK 
COULD RUPTURE. THERE IS A SEPARATE RELIEF PORT FOR TANKS 3 & 5. 
THIS IS CRITICALITY 3/1R BECAUSE SAME TANK’S HEATERS 
WOULD HAVE TO FAIL ON AND ITS CHECK VALVE FAIL CLOSED. THIS IS 
DETECTABLE FROM TANK PRESSURE GAUGES OVER A PERIOD OF TIME. 


REFERENCES : 




REPORT DATE 12/03/86 


C-16 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

215 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 RELIEF PORT 2 (1) 

FAILURE MODE: RESTRICTED FLOW 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

HYDROGEN STORAGE 

4) 

H2 TANKS 

5) 


6) 


7) 


8) 


9) 



FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 

3/1R 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


REDUNDANCY SCREENS: A [ 1 ] B [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 40V45VP045 


HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 


C [ P ] 


CAUSES: BLOCKAGE, CONTAMINATION, DEBRIS 


EFFECTS/RATIONALE : 

H2 RELIEF PORT 2 VENTS H2 FROM TANKS 3 & 5 RELIEF VALVES. IF 
RESTRICTED, IT WOULD NOT RELIEVE OVERPRESSURIZATION AND A TANK 
COULD RUPTURE. THIS CAN DETECTED BY LOOKING AT TANK PRESSURE 
GAUGES OVER A PERIOD OF TIME. THERE IS A SEPARATE RELIEF PORT 
FOR TANKS 1, 2, AND 4. THIS IS CRITICALITY 3/1R BECAUSE HEATERS 
WOULD HAVE TO FAIL ON AND THE CHECK VALVE FAIL CLOSED FOR THE 
SAME TANK. 


REFERENCES : 


REPORT DATE 12/03/86 


C-17 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

216 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 TANK SUBASSEMBLY (5) 

FAILURE MODE: EXTERNAL LEAKAGE 


r 

L 

E 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


I ) 

EPG 




l 

2) 

PRSD 




t... 

3 ) 

HYDROGEN STORAGE 





4 ) 

H2 TANKS 





5 ) 






6 ) 






7 ) 





W' 

8 ) 






9 ) 





¥ 



CRITICALITIES 




FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

- 


PRELAUNCH: 

1/1 

RTLS: 

1/1 



LIFTOFF: 

1/1 

TAL: 

1/1 

l 


ONORBIT: 

1/1 

AO A: 

1/1 



DEORBIT: 

1/1 

ATO: 

1/1 



LANDING/SAFING: 

1/1 



?■ 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: CORROSION, FATIGUE, TEMPERATURE, POROSITY, 

OVERPRESSURIZATION 

EFFECTS/RATIONALE : 

A LEAK IN TANK OR THROUGH RELIEF VALVE WOULD CAUSE DEPLETION OF 
H2 AND FUEL CELL SHUTDOWN. LEAKAGE UNDER THE PAYLOAD BAY MAY 
CAUSE OTHER SYSTEMS TO FREEZE AND A POSSIBLE EXPLOSION. THIS IS 
DETECTABLE THROUGH QUANTITY SENSORS AND CONSOLE CHARTS OVER A 
PERIOD OF TIME. 


REFERENCES : j, 

k 


REPORT DATE 12/03/86 


C-18 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

217 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 TANK SUBASSEMBLY 

FAILURE MODE: RUPTURE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

1/1 

RTLS 

LIFTOFF: 

1/1 

TAL: 

ONORBIT: 

1/1 

AO A: 

DEORBIT: 

1/1 

ATO: 

LANDING/SAFING: 

1/1 



HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: OVERPRESSURIZATION, TEMPERATURE, FATIGUE 

EFFECTS/RATIONALE : 

THE H2 IN THE TANK WOULD BE LOST, AND OTHER EXPLOSIONS MAY 
RESULT. SHRAPNEL MAY PUNCTURE OTHER SYSTEMS AND THE EXTERIOR OF 
THE ORBITER. THIS IS DETECTABLE THROUGH QUANTITY AND PRESSURE 
SENSORS . 


REFERENCES : 


REPORT DATE 12/03/86 


C-19 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

218 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 TANK SUBASSEMBLY 

FAILURE MODE: LOSS OF ANNULUS VACUUM 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) 

6 ) 

7 ) 

8) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 82-0063-0200 


CAUSES: HOLE IN OUTER TANK 

EFFECTS/RATIONALE : 

CONDUCTIVE AND CONVECTIVE HEAT TRANSFER COULD OCCUR WITHOUT A 
VACUUM, CAUSING THE REACTANT TO HEAT UP AND BE DEPLETED QUICKLY. 
THE CAUSE COULD BE FAILURE OF THE VACUUM IONIZATION PUMP AND VAC 
ION PUMP PRESSURE SENSOR ON GROUND. THIS IS DETECTABLE FROM 
TANK QUANTITY SENSORS AND CONSOLE QUANTITY CHARTS OVER A PERIOD 
OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-20 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

219 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: H2 TANK HEATER ASSEMBLY TEMPERATURE SENSOR (5) 

V45T21(~5) 07A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

FAILURE OF THE SENSOR CAN BE DETECTED BY CHECKING THE TANK FLUID 
TEMPERATURE OR PRESSURE SENSORS. THE SENSOR IS ONLY CONNECTED TO 
A GAUGE; IT DOES NOT AFFECT HEATER OPERATION. FULL OUTPUT 
NORMALLY INDICATES THAT HEATERS ARE CONTINUOUSLY ENERGIZED. 


REFERENCES : 


REPORT DATE 12/03/86 


C-21 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

220 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK HEATER ASSEMBLY TEMPERATURE SENSOR (5) 

V45T21 (*-5) 07A 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


i 


% 

*-■ 




i 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

ZERO OUTPUT NORMALLY INDICATES THAT THE HEATERS ARE NOT 
OPERATING. LOSS OF THE SENSOR HAS NO HAZARDOUS EFFECT ON THE 
MISSION OR CREW. 


REFERENCES : 


REPORT DATE 12/03/86 


C-22 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

221 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: H2 TANK HEATER ASSEMBLY TEMPERATURE SENSOR (5) 

V45T21(-5) 07A 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7 ) 

8) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AOA: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 


EFFECTS/RATIONALE : 

AN INACCURATE READING MAY CAUSE THE CREW TO WANT TO MANUALLY 
OPERATE HEATERS, TO KEEP THE TEMPERATURE READING WITHIN 
TOLERANCES . 


REFERENCES : 


REPORT DATE 12/03/86 


C-23 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 222 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: H2 TANK FLUID TEMPERATURE SENSOR (5) V45T21(-4) 01A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

FAILURE OF THE SENSOR HAS NO EFFECT ON HEATER OPERATION. FAILURE 
OF SENSOR CAN BE DETECTED BY CHECKING HEATER ASSEMBLY TEMPERATURE 
SENSOR OR TANK PRESSURE SENSOR. FULL OUTPUT WOULD NORMALLY 
INDICATE THAT THE HEATERS WERE CONTINUALLY ENERGIZED. 


REFERENCES : 


REPORT DATE 12/03/86 


C-24 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 223 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: H2 TANK FLUID TEMPERATURE SENSOR (5) V45T21(-4) 01A 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

ABORT 

3/3 

RTLS 

3/3 

TAL: 

3/3 

AO A: 

3/3 

ATO: 

3/3 



REDUNDANCY SCREENS: A [NA ] B [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


C [NA ] 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 
EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD NORMALLY INDICATE THAT THE HEATERS WERE NOT 
OPERATING. LOSS OF THE SENSOR HAS NO HAZARDOUS EFFECT ON THE 
CREW OR MISSION. 


REFERENCES : 


REPORT DATE 12/03/86 


C-25 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 224 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK FLUID TEMPERATURE SENSOR (5) V45T21 (-4) 01A 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7 ) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

AN INACCURATE READING MAY CAUSE CREW TO WANT TO MANUALLY OPERATE 
HEATERS, TO KEEP THE TEMPERATURE READING WITHIN TOLERANCES. 


REFERENCES : 


REPORT DATE 12/03/86 


C-2 6 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 225 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK QUANTITY SENSOR (5) V45Q21(-5) 05A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

FAILURE OF THE SENSOR HAS NO EFFECT ON HEATER OPERATION. THE 
SENSOR FAILURE CANNOT BE VERIFIED BY LOOKING AT OTHER 
INSTRUMENTATION. THE CREW WOULD ONLY KNOW THAT TANK CANNOT 
ALWAYS BE FULL. CREW MIGHT BE ABLE TO FIGURE OUT APPROXIMATE 
QUANTITY BY TURNING HEATERS ON FOR A CERTAIN TIME AND MEASURE 
CORRESPONDING FLUID TEMPERATURE OR PRESSURE RISE. 


REFERENCES : 


REPORT DATE 12/03/86 


C-27 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 226 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK QUANTITY SENSOR (5) V45Q21(“5) 05A 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD HAVE NO AUTOMATIC EFFECT ON THE HEATERS. ZERO 
OUTPUT WOULD CAUSE THE CREW TO WANT TO TURN HEATERS OFF AND 
DEACTIVATE TANK. 


REFERENCES : 


REPORT DATE 12/03/86 


C-28 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 227 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 TANK QUANTITY SENSOR (5) V45Q21(-5) 05A 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN STORAGE 

4) H2 TANKS 

5) H2 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0200 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

AN INACCURATE READING MAY CAUSE CREW TO CHANGE THE TANK 
MANAGEMENT SCHEME. THE CREW COULD OPERATE THE TANK MISTAKENLY 
BELOW ITS REDLINE LIMIT. 


REFERENCES : 


REPORT DATE 12/03/86 


C-29 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/26/86 

SUBSYSTEM: EPG 

MDAC ID: 228 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 LINES , COMPONENTS, & FITTINGS 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) 

5) 

6 ) 


7) 

8) 
9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: VO70-454898 


CAUSES: SHOCK, VIBRATION, FATIGUE, OVERPRESSURE, BRITTLENESS DUE 

TO TEMPERATURE 


EFFECTS/RATIONALE : 

ALL REACTANT COULD BE DEPLETED AND CAUSE FUEL CELL SHUTDOWN; 
ALSO, A LEAK COULD CAUSE CRYO TO FREEZE OTHER SYSTEMS UNDER THE 
PAYLOAD BAY. THE LEAKING H2 COULD ALSO CAUSE AN EXPLOSION. 
LEAKING IS DETECTABLE FROM TANK QUANTITY AND PRESSURE SENSORS 
OVER A PERIOD OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-3 0 



INDEPENDENT ORBITER ASSESSMENT ' 

ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
2/1R 
1/1 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) 

5) 

6) 

7) 

8 ) 

9 ) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


9/26/86 

EPG 

229 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


H2 LINES, COMPONENTS, & FITTINGS 
RESTRICTED FLOW 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

2/1R 

TAL: 

1/1 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 
LANDING/S AFING: 

3/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: VO70-454898 


CAUSES: CONTAMINATION, DEBRIS 

EFFECTS/RATIONALE : 

RESTRICTED FLOW COULD CAUSE NO REACTANT TO REACH THE FUEL CELLS, 
AND THUS CAUSE THEM TO BE SHUTDOWN. OVERPRESSURE COULD BE VENTED 
OUT THE TANK RELIEF VALVES AND MANIFOLD RELIEF VALVES. THIS IS 
DETECTABLE FROM TANK PRESSURE SENSORS. THIS IS 

CRITICALITY 1/1 FOR TAL BECAUSE A BLOCKAGE IN LINE TO FUEL CELL 1 
WOULD CAUSE LOSS OF OMS PURGE CAPABILITY. THIS IS CRITICALITY 
1/1 FOR RTLS BECAUSE A BLOCKAGE IN LINE TO FUEL CELL 1 WOULD 
CAUSE LOSS OF AFT COMPARTMENT MPS HELIUM PURGE CAPABILITY. 


REFERENCES : 


REPORT DATE 12/03/86 


C-31 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

9/29/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 

FLIGHT: 

3/1R 

MDAC ID: 

230 

ABORT: 

3/1R 

ITEM: 

H2 FILTER 

(5) FLO 3 0 , FLO 4 0 , FL5 0 0 , FL5 6 0 


FAILURE MODE 

i: RESTRICTED 

FLOW, CLOGGED 


LEAD ANALYST 

: S. GOTCH 

SUBSYS LEAD: M. HIOTT 



BREAKDOWN HIERARCHY: f- 

1) EPG | 

2) PRSD 

3) H2 DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES l 

5) f 

6 ) 

7) r 

8) l 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P 3 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC266-0054-0001 


CAUSES: CONTAMINATION, DEBRIS, DAMAGED ELEMENT 

EFFECTS/RATIONALE : 

EACH H2 AND 02 CRYO TANK HAS A FILTER FOR ITS REACTANT POSITIONED 
AHEAD OF ITS CHECK VALVE. THE FILTER IS REPLACED EVERY 15 
FLIGHTS. IF THE FILTER CLOGS, REACTANTS ARE UNABLE TO GET TO THE 
FUEL CELLS, AND REACTANT IS DEPLETED OUT THE TANK RELIEF 
VALVE. THIS FAILURE IS DETECTED USING THE TANK PRESSURE SENSOR. 


REFERENCES : 

f 

t 

fr' 


REPORT DATE 12/03/86 


C~32 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/09/86 

EPG 

231 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 MANIFOLD 1 RELIEF VALVE (1) RV031 

FAILURE MODE: FAILED OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0004 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

LOSS OF RV0 31 BY ITSELF WOULD HAVE NO EFFECT. LOSS OF RV041 
ALSO, STILL WOULD HAVE NO EFFECT. IF THE TANK 1 RELIEF VALVE 
ALSO FAILED OPEN, IT COULD LOSE ALL REACTANT, THUS THE 
CRITICALITY IS 2/1R. IT MAY BE POSSIBLE TO DETECT THIS FAILURE 
OVER A PERIOD OF TIME WITH THE TANK 1 QUANTITY SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-33 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/09/86 


HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 




FLIGHT: 

3/1R 

MDAC ID: 

232 




ABORT: 

3/1R 

ITEM: 

H2 MANIFOLD 1 

RELIEF 

VALVE 

(1) 

RV031 


FAILURE MODE 

!: FAILS CLOSED 






LEAD ANALYST 

: S. GOTCH 

SUBSYS 

LEAD: 

M. 

HIOTT 



BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/XR 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/1R 



REDUNDANCY SCREENS: 

A [ 1 ] 

B C P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0004 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

A PRESSURE BUILDUP AND POSSIBLE LINE RUPTURE COULD RESULT IF BOTH 
RV031 AND RV041 WERE CLOSED. ANY TANK WOULD HAVE TO HAVE ITS OWN 
RELIEF VALVE FAILED CLOSED, PLUS ITS HEATERS FAILED ON (OR IN 
MANUAL MODE) TO PRESSURIZE THE LINES ABOVE 3 02 PSIG. 

THIS IS DETECTABLE FROM THE MANIFOLD PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-34 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/09/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 1/1 

MDAC ID: 233 ABORT: 1/1 

ITEM: H2 MANIFOLD 1 RELIEF VALVE (1) RV031 

FAILURE MODE: EXTERNAL LEAKAGE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0004 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 

EFFECTS/RATIONALE : 

THIS IS CRITICALITY 1/1 BECAUSE A LEAK COULD CAUSE POSSIBLE 
EXPLOSION OR FREEZING UNDER THE PAYLOAD BAY. A LEAK IS 
DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-35 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

234 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 MANIFOLD 2 RELIEF VALVE (1) RV041 

FAILURE MODE: FAILED OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

3) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A : 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDXNG/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ l ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0004 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

LOSS OF RV041 BY ITSELF WOULD HAVE NO EFFECT. LOSS OF RV031 ALSO 
WOULD STILL HAVE NO EFFECT. IF TANK 2 RELIEF VALVE ALSO FAILED 
OPEN, IT COULD LOSE ALL REACTANT, THUS THE CRITICALITY IS 2/1R. 

IT MAY BE POSSIBLE TO DETECT THIS FAILURE OVER A PERIOD 
OF TIME WITH THE TANK 2 QUANTITY SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-36 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

235 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 MANIFOLD 2 RELIEF VALVE (1) RV041 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FU* 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/1R 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0004 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

A PRESSURE BUILDUP AND POSSIBLE LINE RUPTURE COULD RESULT IF BOTH 
RV031 AND RV041 FAIL CLOSED. THE CAUSE OF AN EXCESSIVE PRESSURE 
BUILDUP WOULD BE TANK HEATERS FAILED ON. IT IS CRITICALITY 3/1R 
IF A TANK'S HEATERS FAIL ON AND TANK RELIEF VALVE FAILS 
CLOSED. THIS IS DETECTABLE FROM THE MANIFOLD PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-37 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

236 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 MANIFOLD 2 RELIEF VALVE (1) RV041 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

1/1 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 8 4 -044 0-0 004 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 


EFFECTS/RATIONALE : 

THIS IS CRITICALITY 1/1 BECAUSE A LEAK COULD CAUSE POSSIBLE 
EXPLOSION OR FREEZING UNDER PAYLOAD BAY. A LEAK IS DETECTABLE 
OVER A PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-38 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/30/86 

SUBSYSTEM: EPG 

MDAC ID: 237 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 CHECK VALVE (2) CV031,CV041 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

Mi] 

B [ F ] 

c [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

CV 031 CHECKS FLOW INTO TANK 3, CV041 CHECKS FLOW INTO TANKS 4 AND 
5. HIGHER PRESSURE DOWNSTREAM OF THE CHECK VALVE THAN UPSTREAM 
WOULD FORCE REACTANT INTO THE TANK LINE. LOW PRESSURE IN THE TANK 
OR A LEAK WOULD HAVE TO OCCUR ALSO, IN ADDITION TO A CHECK 
VALVE FAILURE. THE RESULT COULD BE LOWER CRYO FLOW TO THE FUEL 
CELLS AND A POSSIBLE SHUTDOWN. THIS FAILS SCREEN B BECAUSE A 
TANK LEAK OR RELIEF VALVE FAILED OPENED IS NEEDED FOR THE FAILURE 
TO BE DETECTABLE. THIS IS CRITICALITY 2/1R BECAUSE A COMBINED 
FAILURE OF THE TANK RELIEF VALVE OPEN COULD LOSE ALL REACTANTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-39 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/30/86 

SUBSYSTEM: EPG 

MDAC ID: 238 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 CHECK VALVE (2) CV031,CV041 

FAILURE MODE: FAILS CLOSED (RESTRICTED FLOW ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/XR 

DEORBIT: 

3/XR 

ATO: 

3/XR 

LANDING/SAFING: 

3/1R 



REDUNDANCY SCREENS: 

A C 1 ] 

B [ P ] 

c [ p 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

REACTANT IS UNABLE TO LEAVE THE TANK. THIS DEPLETES H2 OUT OF 
THE RELIEF VALVE AND COULD FORCE FUEL CELL SHUTDOWN. THIS IS 
DETECTABLE FROM THE TANK PRESSURE SENSOR. FAILURE ALSO OF THE 
TANK RELIEF VALVE CLOSED, HEATERS ON IN MANUAL MODE, OR FAILED 
ON, COULD CAUSE AN EXPLOSION, THUS THE CRITICALITY IS 3/1R. 


REFERENCES : 


REPORT DATE 12/03/86 


C-40 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 RELIEF VALVE/FILTER PACKAGES 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


9/30/86 

EPG 

239 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


H2 CHECK VALVE (2) CV031,CV041 
EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

REACTANT DEPLETION INTO THE AREA UNDER THE PAYLOAD BAY COULD 
CAUSE EXPLOSION, OR FREEZE OTHER SYSTEMS. THIS MAY RESULT IN LOW 
OR NO CRYO FLOW INTO FUEL CELLS. THIS IS DETECTABLE FROM TANK 
QUANTITY AND PRESSURE SENSORS AND MANIFOLD PRESSURE SENSORS 
OVER A PERIOD OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-41 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/01/86 

SUBSYSTEM: EPG 

MDAC ID: 240 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: H2 CHECK VALVE (1) CV030 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


I 

I 

ft 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5) 

6 ) 

7 ) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c [ P ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 




CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

CV030 CHECKS FLOW INTO TANK 1. HIGHER PRESSURE DOWNSTREAM OF 
CHECK VALVE THAN UPSTREAM WOULD FORCE REACTANT INTO TANK LINE. 
LOW PRESSURE IN TANK OR A LEAK WOULD HAVE TO OCCUR IN ADDITION TO 
THE CHECK VALVE FAILURE. THE RESULT COULD BE LOWER CRYO FLOW 
TO FUEL CELLS AND POSSIBLE SHUTDOWN. THIS FAILS SCREEN B BECAUSE 
NEED A TANK LEAK OR RELIEF VALVE FAILED OPEN TO DETECT. THIS IS 
CRITICALITY 2/1R BECAUSE COMBINED FAILURE OF TANK RELIEF VALVE 
OPEN COULD LOSE THE VEHICLE DUE TO REACTANT LOSS. 


REFERENCES : f 

L 


i 


REPORT DATE 12/03/86 


C-42 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/01/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/1R 

MDAC ID: 241 ABORT: 2/1R 

ITEM: H2 CHECK VALVE (1) CV030 

FAILURE MODE: FAILS CLOSED (RESTRICTED FLOW ALSO) 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5 ) 

6 ) 

7 ) 

8) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

2/1R 

LIFTOFF: 

3/1R 

TAL: 

2/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/ SAFING: 

3/1R 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

REACTANT IS UNABLE TO LEAVE TANK. THIS DEPLETES H2 OUT THE 
RELIEF VALVE AND COULD CAUSE FUEL CELL SHUTDOWN. THIS IS 
DETECTABLE FROM THE TANK PRESSURE SENSOR. FAILURE ALSO OF RELIEF 
VALVE COULD CAUSE TANK EXPLOSION, IF HEATER IS ON IN MANUAL MODE 
OR FAILED ON. THIS IS CRITICALITY 2/1R SINCE IF CV03 0 AND LV031 
FAILED CLOSED DURING TAL AND RTLS COULD LOSE OMS PURGE 
CAPABILITY, AND MPS HELIUM PURGE CAPABILITY RESPECTIVELY. 


REFERENCES : 


REPORT DATE 12/09/86 


C-43 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/01/86 

EPG 

242 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 CHECK VALVE (1) CV030 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5) 

6 ) 

7) 

8) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

REACTANT DEPLETION INTO THE AREA UNDER PAYLOAD BAY COULD CAUSE 
EXPLOSION OR FREEZE OTHER SYSTEMS. THIS MAY RESULT IN LOW OR NO 
CRYO FLOW INTO FUEL CELLS. THIS FAILURE IS DETECTABLE FROM TANK 
QUANTITY SENSORS AND CONSOLE QUANTITY CHARTS OVER A PERIOD 
OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-44 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/29/86 

EPG 

243 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 CHECK VALVE (1) CV040 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6) 

7) 

8 ) 
9 ) 


EPG 

PRSD 

HYDROGEN DISTRIBUTION 
H2 VALVE MODULE 2 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ l 3 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

CV040 CHECKS FLOW INTO H2 TANK 2. HIGHER PRESSURE DOWNSTREAM OF 
CHECK VALVE THAN UPSTREAM WOULD FORCE REACTANT INTO TANK. LOW 
PRESSURE IN TANK OR LEAK WOULD HAVE TO OCCUR IN ADDITION TO CHECK 
VALVE FAILURE. THE RESULT COULD BE LOWER CRYO FLOW TO FUEL 
CELLS AND POSSIBLE SHUTDOWN. FAILS SCREEN B BECAUSE NEED A TANK 
LEAK OR RELIEF VALVE FAILED OPEN TO DETECT. 2/1R BECAUSE 
COMBINED FAILURE OF TANK RELIEF VALVE OPEN COULD LOSE VEHICLE DUE 
TO REACTANT LOSS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-45 



j. 

t : 


INDEPENDENT ORBITER ASSESSMENT 4 

ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC I 

3/1R 

3/18 F 

i. 


BREAKDOWN HIERARCHY: 


1) 

EPG 

if; 

2) 

PRSD 


3) 

HYDROGEN DISTRIBUTION 


4) 

H2 VALVE MODULE 2 

I 

5) 


ff 
\L ■ 

6) 



7) 


P 

8) 


R- 

9) 




DATE: 

SUBSYSTEM: 
MDAC ID: 


10/29/86 

EPG 

244 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


H2 CHECK VALVE (1) CV040 

FAILS CLOSED (RESTRICTED FLOW ALSO) 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/1R 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-Q010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

REACTANT IS UNABLE TO LEAVE TANK. THIS DEPLETES H2 OUT THE 
RELIEF VALVE AND COULD CAUSE FUEL CELL 2 SHUTDOWN IF LV041 WAS 
CLOSED. THIS IS DETECTABLE FROM TANK PRESSURE SENSOR. 

FAILURE ALSO OF RELIEF VALVE COULD CAUSE TANK EXPLOSION, IF 
HEATER IS ON IN MANUAL MODE OR FAILED ON. 


REFERENCES : 


REPORT DATE 12/03/86 


C-46 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/29/86 

EPG 

245 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 CHECK VALVE (1) CV040 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7) 

8) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/ SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


C [NA ] 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

REACTANT DEPLETION INTO THE AREA UNDER PAYLOAD BAY COULD CAUSE 
EXPLOSION OR FREEZE OTHER SYSTEMS. THIS MAY RESULT IN LOW OR NO 
CRYO FLOW INTO FUEL CELLS. THIS FAILURE IS DETECTABLE FROM TANK 
QUANTITY SENSORS AND CONSOLE QUANTITY CHARTS OVER A PERIOD 
OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-47 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
2/1R 
2/1R 

8 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/01/86 

EPG 

246 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


H2 HORIZONTAL DRAIN QD (1) TYPE II, CLASS 
EXTERNAL LEAKAGE 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c [ p ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0280 



CAUSES: CONTAMINATION, FATIGUE, 

CORROSION 



EFFECTS/RATIONALE : 

HORIZONTAL DRAIN IS USED AFTER LANDING TO DRAIN REMAINING 
REACTANT FROM PRSD. IF QD AND CAP BOTH LEAK, LOSS OF ALL 
REACTANT COULD OCCUR, POSSIBLY CAUSING FUEL CELL SHUTDOWN. CAP 
AND FILL QD'S ARE REDUNDANT ITEMS FOR THIS QD. 

CANNOT DETECT LOSS OF QD ITSELF. 


REFERENCES : 


REPORT DATE 12/03/86 


C-48 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/01/86 

EPG 

247 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 HORIZONTAL DRAIN QD (1) TYPE II, CLASS 8 

FAILURE MODE: INABILITY TO MATE/DEMATE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9 ) 


EPG 

PRSD 

HYDROGEN DISTRIBUTION 
H2 VALVE MODULE 1 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0280 


CAUSES: CORROSION, BINDING, DEBRIS 

EFFECTS/RATIONALE : 

DRAIN QD IS NOT USED AT LAUNCH PAD. NO EFFECT AFTER LANDING 
BECAUSE MISSION HAS ALREADY ENDED AND CAN DRAIN H2 THROUGH FILL 
QD. 


REFERENCES : 


REPORT DATE 12/03/86 


C-49 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

248 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 HORIZONTAL DRAIN CAP (1) 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0260 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE : 

THE CAP IS A LEVEL OF REDUNDANCY OVER THE QD. REACTANT CANNOT 
LEAK OUT UNLESS THE QD ALSO LEAKS. IF BOTH THE CAP AND QD LEAK, 
COULD LOSE ALL H2. CANNOT DETECT LOSS OF CAP ALONE. 


REFERENCES : 


REPORT DATE 12/03/86 


C~50 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/02/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/3 

MDAC ID: 249 ABORT: 3/3 

ITEM: H2 MANIFOLD PRESSURE SENSOR (2) 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 


2) 

PRSD 


3) 

HYDROGEN 

DISTRIBUTION 

4) 

H2 VALVE 

MODULES 

5) 



6) 



7) 



8) 



9) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: ME 449-0177-2501 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

MANIFOLD 1 SENSOR MEASURES PRESSURE BETWEEN TANK 1 CHECK VALVE, 
FUEL CELL 1 SUPPLY VALVE, MANIFOLD 1 RELIEF VALVE, AND MANIFOLD 1 
CROSSOVER VALVE. MANIFOLD 2 SENSOR MEASURES PRESSURE BETWEEN 
TANK 2 CHECK VALVE, FUEL CELL 2 SUPPLY VALVE, H2 GSE 
SUPPLY VALVE, MANIFOLD 2 CROSSOVER VALVE AND MANIFOLD 2 RELIEF 
VALVE. THESE SENSORS HAVE NO EFFECT ON OTHER COMPONENTS. 
MANIFOLD RELIEF VALVE WOULD DISSIPATE EXCESS PRESSURE. 


REFERENCES: 


REPORT DATE 12/03/86 


C-51 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

EPG 

250 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 MANIFOLD PRESSURE SENSOR (2) 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULES 

5) 

6 ) 

7) 

8) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FU 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: ME 449-0177-2501 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 


EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE THE CREW TO CHECK FUEL CELL H2 FLOW 
METERS AND TANK PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-52 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/3 
3/3 

ITEM: H2 MANIFOLD PRESSURE SENSOR (2) 

FAILURE MODE: OUT OF TOLERANCE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

EPG 

251 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


BREAKDOWN 
1) EPG 


HIERARCHY: 


2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


PRSD 

HYDROGEN DISTRIBUTION 
H2 VALVE MODULES 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: ME 449-0177-2501 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

INACCURATE READING MAY CAUSE THE CREW TO CHECK FUEL CELL H2 
FLOWMETERS AND TANK PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-53 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/27/86 

EPG 

252 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 MANIFOLD 1 SOLENOID CROSSOVER VALVE (1) LV031 

FAILURE MODE: FAILS OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN 
1) EPG 


HIERARCHY: 


2) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


PRSD 

HYDROGEN DISTRIBUTION 
H2 VALVE MODULE 1 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4210 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRIC SIGNAL 


EFFECTS/RATIONALE : 

LV031 IS USED TO ISOLATE H2 FLOW IN TANK 1 AND VALVE MODULE 1 
(FUEL CELL 1) FROM FUEL CELL 3 AND VALVE MODULE 2 (FUEL CELL 2) 
AND THE OTHER TANKS. IF THERE IS A LOW PRESSURE PROBLEM IN VALVE 
MODULE 1, LV041 WOULD NEED TO BE CLOSED TO PREVENT LOSS OF 
ALL REACTANT. TANK 1 RELIEF VALVE AND MANIFOLD 1 RELIEF VALVE 
WOULD HAVE TO FAIL OPEN TO LOSE ALL REACTANT. CLOSING LV041 WOULD 
STILL SHUTDOWN FUEL CELLS 1 AND 3. 


REFERENCES : 


REPORT DATE 12/03/86 


C-54 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/27/86 

EPG 

253 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/2R 

ABORT: 2/1R 


ITEM: H2 MANIFOLD 1 SOLENOID CROSSOVER VALVE (1) LV031 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/2R 

TAL: 

ONORBIT: 

3/2R 

AO A: 

DEORBIT: 

3/2R 

ATO: 

LANDING/ SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4210 



HDW/FUNC 

2/1R 

2/1R 

3/2R 

3/2R 


C [ P ] 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRIC SIGNAL 


EFFECTS/RATIONALE : 

IF BOTH CROSSOVER VALVES FAIL SHUT, TANKS 1 AND 2 WOULD DEPLETE 
FASTER SINCE EACH WOULD HAVE TO FEED A FUEL CELL ALONE. ANY 
FAILURES THAT PREVENT THE DISTRIBUTION OF THE CONTENTS OF TANKS 1 
AND 2 COULD SHUTDOWN 2 FUEL CELLS. 2/1R FOR TAL BECAUSE 
FAILURE OF TANK 1 OR ITS CHECK VALVE COULD CAUSE FUEL CELL 1 
SHUTDOWN AND OMS PURGE LOSS. ALSO, THIS IS CRITICALITY 2/1R FOR 
RTLS BECAUSE HELIUM PURGE CAPABILITY WOULD BE LOST. DETECTABLE 
FROM VALVE POSITION INDICATOR. 3/2R IF TANK 1 HAS ITS CHECK 
VALVE OR FILTER CLOSED , OR TANK RELIEF VALVE OPEN. 


REFERENCES : 


REPORT DATE 12/03/86 


C-55 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/27/86 

EPG 

254 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 MANIFOLD 1 SOLENOID CROSSOVER VALVE (1) LV031 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5) 

6 ) 

7 ) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 
HDW/FUNC ABORT 


1/1 

1/1 

1/1 

1/1 

1/1 


RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4210 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER THE PAYLOAD BAY COULD CAUSE 
EXPLOSION OR POSSIBLE FREEZING OF OTHER SYSTEMS. IF ONLY LV031 
LEAKS, CAN USE LV041 TO ISOLATE LEAK, BUT MAY LOSE FUEL CELLS 1 
AND 3. IF BOTH MANIFOLD CROSSOVER VALVES LEAK, MAY CAUSE LOSS OF 
ALL REACTANTS. A LEAK IS DETECTABLE OVER A PERIOD OF TIME FROM 
CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C“56 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/03/86 

EPG 

255 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 FUEL CELL 1 SOLENOID REACTANT SUPPLY VALVE (1) 

LV033 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 


2) 

PRSD 


3) 

HYDROGEN 

DISTRIBUTION 

4) 

H2 VALVE 

MODULE 1 

5) 



6) 



7) 



8) 



9) 




FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 
HDW/FUNC ABORT 


2/1R 

2/1R 

2/1R 

2/1R 

2/1R 


RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

2/1R 

2/1R 

2/1R 

2/1R 


REDUNDANCY SCREENS: A [ 1 ] B[P] C[P] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

IF LV033 FAILS OPEN, CAN USE LV031 AND IF NEEDED, LV041 TO 
ISOLATE FUEL CELL 1. THIS IS CRITICALITY 2/1R BECAUSE IF FUEL 
CELL IS SHUT DOWN BECAUSE OF ONE OF ITS COMPONENTS, THEN THE 
REACTANT FLOW HAS TO BE STOPPED OR AN EXPLOSION COULD OCCUR. 

IF CREW CANNOT CLOSE VALVE, MISSION ABORT DECISION WOULD RESULT. 


REFERENCES : 


REPORT DATE 12/03/86 


C-57 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/03/86 

EPG 

256 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

1/1 


ITEM: H2 FUEL CELL 1 SOLENOID REACTANT SUPPLY VALVE (1) 

LV033 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

2/1R 

TAL: 

1/1 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

3/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B C P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV033 IS USED TO CONTROL H2 FLOW INTO FUEL CELL 1. 2/1R FOR 

ABORT/ASCENT BECAUSE IF 2 FUEL CELL REACTANT VALVES FAIL, THEN 
ORBITER IS LOST. EARLIEST ORBITER CAN OPERATE ON ONLY 1 FUEL 
CELL IS AFTER MECO. CAN DETECT USING FUEL CELL FLOW METER. 

1/1 FOR TAL BECAUSE OMS PURGE CAPABILITY WILL BE LOST, AND 1/1 
FOR RTLS BECAUSE HELIUM PURGE CAPABILITY WILL BE LOST. FAILURE 
ONORBIT CAUSES PRIORITY FLIGHT DECISION. 


REFERENCES : 


REPORT DATE 12/03/86 


C-58 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/03/86 

EPG 

257 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 FUEL CELL 1 SOLENOID REACTANT SUPPLY VALVE (1) 

LV033 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9 ) 


EPG 

PRSD 

HYDROGEN DISTRIBUTION 
H2 VALVE MODULE 1 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. LEAK MAY PREVENT FUEL CELL FROM 
RECEIVING ADEQUATE REACTANT. 

LEAK IS DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE QUANTITY 
CHARTS. 


REFERENCES : 


C 


- A. 


REPORT DATE 12/03/86 


C-59 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

258 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 FUEL CELL 2 SOLENOID REACTANT SUPPLY VALVE (1) 

LV043 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

2/1R 



REDUNDANCY SCREENS: 

A [ 1 ] 

B .[ P 3 

cep] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, JAMMING, 

CONTAMINATION, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

IF LV043 FAILS OPEN, CREW CAN USE LV041 AND IF NEEDED, LV031 TO 
ISOLATE FUEL CELL 2. THIS IS CRITICALITY 2/1R BECAUSE IF FUEL 
CELL IS SHUT DOWN BECAUSE OF ONE OF ITS COMPONENTS, THEN THE 
REACTANT FLOW HAS TO BE STOPPED OR AN EXPLOSION COULD OCCUR. 

IF CANNOT CLOSE VALVE, MISSION ABORT DECISION WOULD RESULT. 


REFERENCES : 


REPORT DATE 12/03/86 


C-60 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

259 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 FUEL CELL 2 SOLENOID REACTANT SUPPLY VALVE (1) 

LV043 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS : 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ p ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV043 IS USED TO CONTROL H2 FLOW INTO FUEL CELL 2. 2/1R FOR 

ABORT/ASCENT BECAUSE IF 2 FUEL CELL REACTANT VALVES FAIL, THEN 
ORBITER IS LOST. THE EARLIEST THE ORBITER CAN OPERATE ON ONLY 1 
FUEL CELL IS AFTER MECO. DETECTABLE USING FUEL CELL FLOWMETER. 


REFERENCES : 


REPORT DATE 12/03/86 


C-61 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

260 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: H2 FUEL CELL 2 SOLENOID REACTANT SUPPLY VALVE (1) 

LV043 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6) 

7) 

8) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: CORROSION, FATIGUE VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. LEAK MAY PREVENT FUEL CELL FROM 
RECEIVING ADEQUATE REACTANT. LEAK IS DETECTABLE OVER A PERIOD OF 
TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-62 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/06/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 2/1R 

MDAC ID: 261 ABORT: 2/1R 

ITEM: H2 FUEL CELL 3 SOLENOID REACTANT SUPPLY VALVE (1) 

LV044 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7) 

8) 

8 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

2/1R 


REDUNDANCY SCREENS: 

A [ 1 ] 

B C P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, JAMMING, 

CONTAMINATION, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV044 IS USED TO CONTROL H2 FLOW INTO FUEL CELL 3. IF LV044 
FAILS, CREW WOULD HAVE TO USE BOTH LV041 AND LV031 TO ISOLATE 
FUEL CELL 3. THIS IS CRITICALITY 2/1R BECAUSE IF FUEL CELL IS 
SHUT DOWN BECAUSE OF ONE OF ITS COMPONENTS, THEN THE REACTANT 
FLOW HAS TO BE STOPPED OR AN EXPLOSION COULD OCCUR. IF CREW 
CANNOT CLOSE VALVE, MISSION ABORT DECISION WOULD RESULT. 


REFERENCES : 


REPORT DATE 12/03/86 


C-63 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

262 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 FUEL CELL 3 SOLENOID REACTANT SUPPLY VALVE (1) 

LV044 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 


2) 

PRSD 


3) 

HYDROGEN 

DISTRIBUTION 

4) 

H2 VALVE 

MODULE 2 

5) 



6) 



7) 



8) 



8) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFFS" 

2/1R 

TAL: 

2/1R 

ONORBITs 

2/1R 

AO A: 

2/1R 

DEORBIT: 

3/1R 

ATO: 

2/1R 

LANDING/S AFING: 

3/3 


REDUNDANCY SCREENS: 

A C 1 ] 

B[P] 

c [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

THIS IS CRITICALITY 2/XR FOR ASCENT/ ABORT BECAUSE IF 2 REACTANT 
VALVES FAIL CLOSED, THE ORBITER IS LOST. THE EARLIEST THE 
ORBITER CAN OPERATE ON ONLY 1 FUEL CELL IS AFTER MECO. THE 
FAILURE CAN BE DETECTED FROM FUEL CELL FLOWMETER. 


REFERENCES : 


REPORT DATE 12/03/86 


C-64 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/06/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 1/1 

MDAC ID: 263 ABORT: 1/1 

ITEM: H2 FUEL CELL 3 SOLENOID REACTANT SUPPLY VALVE (1) 

LV044 

FAILURE MODE: EXTERNAL LEAKAGE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION : MID FUSELAGE 

PART NUMBER: MC284-0429-4200 


CAUSES: CORROSION, FATIGUE, CONTAMINATION, VIBRATION 

EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. LEAK MAY PREVENT FUEL CELL FROM 
RECEIVING ADEQUATE REACTANT. A LEAK IS DETECTABLE OVER A PERIOD 
OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-65 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

264 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: H2 MANIFOLD 2 SOLENOID CROSSOVER VALVE (1) LV041 

FAILURE MODE: FAILS OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


r 


r 

is 


BREAKDOWN HIERARCHY: 


1) 

EPG 


2) 

PRSD 


3) 

HYDROGEN 

DISTRIBUTION 

4) 

H2 VALVE 

MODULE 2 

5) 



6) 



7) 



8) 



9) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ p 3 

c [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 8 4 -04 2 9 -4 2 10 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV041 IS USED TO ISOLATE H2 FLOW IN TANK 2 AND VALVE MODULE 2 
(FUEL CELL 2) FROM FUEL CELL 3 AND VALVE MODULE 1 (FUEL CELL 1) 
AND THE OTHER TANKS. IF THERE IS LOW PRESSURE IN VALVE MODULE 2, 
CREW CAN USE LV031 TO STOP LOSS OF ALL REACTANT, BUT THIS MAY 
CAUSE SHUTDOWN OF FUEL CELLS 3 AND 2. ASCENT AND ABORT REQUIRE 
AT LEAST 2 FUEL CELLS UNTIL MECO. TANK 2 RELIEF VALVE AND 
MANIFOLD 2 RELIEF VALVE WOULD HAVE TO FAIL OPEN TO LOSE ALL 
REACTANT. LOSS PRELAUNCH WOULD CAUSE MISSION DELAY. 


REFERENCES : 


REPORT DATE 12/03/86 


C-66 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

265 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/2R 

ABORT: 3/2R 


ITEM: H2 MANIFOLD 2 SOLENOID CROSSOVER VALVE (1) LV041 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 


2) 

PRSD 


3) 

HYDROGEN 

DISTRIBUTION 

4) 

H2 VALVE 

MODULE 2 

5) 



6) 



7) 



8) 



9) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/2R 

LIFTOFF: 

3/2R 

TAL: 

3/2R 

ONORBIT: 

3/2R 

AO A: 

3/2R 

DEORBIT: 

3/2R 

ATO: 

3/2R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4210 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

3/2R IF TANK 2 RELIEF VALVE FAILS OPEN OR CHECK VALVE FAILS 
CLOSED. TANK 2 WOULD DEPLETE FASTER SINCE IT ALONE COULD FEED 
FUEL CELL 2. FAILURE IS DETECTABLE FROM VALVE POSITION 
INDICATOR. IF BOTH CROSSOVER VALVES FAIL SHUT, TANK 1 WOULD ALSO 
DEPLETE FASTER SINCE IT ALONE WOULD BE FEEDING FUEL CELL 1. 


REFERENCES : 


REPORT DATE 12/03/86 


C-67 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

f 

DATE: 10/06/86 HIGHEST CRITICALITY HDW/FUNC t. 

SUBSYSTEM: EPG FLIGHT: 1/1 

MDAC ID: 266 ABORT: 1/1 p 

ITEM: H2 MANIFOLD 2 SOLENOID CROSSOVER VALVE (1) LV041 

FAILURE MODE: EXTERNAL LEAKAGE 

| 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT I 

BREAKDOWN HIERARCHY: i; 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7 ) f 

8 ) | 
9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

1/1 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4210 


CAUSES: CORROSION, FATIGUE VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. IF ONLY LV041 LEAKS, CAN USE LV031 TO 
STOP LEAK, BUT COULD LOSE FUEL CELLS 2 AND 3. IF BOTH MANIFOLD 
SHUTOFF VALVES LEAK, ALL FUEL CELLS MAY BE SHUTDOWN. 

THIS LEAK IS DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE 
CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-68 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

267 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: H2 SOLENOID GSE SUPPLY VALVE (1) LV045 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7) 


8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ l 3 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4220 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

LV045 CONTROLS GROUND OPERATION FLOW OF FUEL CELL REACTANT. THIS 
IS CRITICALITY 3/3 DURING PRELAUNCH BECAUSE VALVE IS OPEN UNTIL 
T-0. CRITICALITY 2/1R OTHER PHASES BECAUSE REACTANT WOULD ONLY 
BE CONTAINED BY H2 FILL T-0. LEAK COULD BE ISOLATED BY 
CLOSING LV041. FUEL CELL 2 WOULD PROBABLY BE SHUT DOWN. LEAK 
COULD CAUSE LOSS OF ALL REACTANT. 


REFERENCES : 


REPORT DATE 12/03/86 


C-69 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

268 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 SOLENOID GSE SUPPLY VALVE (1) LV045 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AOA: 

DEORBIT: 

3/3 

ATO: 

LANDING/S AFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4220 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

VALVE IS NORMALLY CLOSED EXCEPT FOR BEFORE T-0. A FAILURE 
PRELAUNCH WOULD CAUSE LAUNCH DELAY. THERE IS NO EFFECT AT OTHER 
TIMES. VALVE FAILING CLOSED AT LAUNCH SITE MAY CAUSE BACK 
PRESSURE ON GSE SUPPLY LINE TO ORBITER. 


REFERENCES : 


REPORT DATE 12/03/86 


C-70 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/06/86 

EPG 

269 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: H2 SOLENOID GSE SUPPLY VALVE (1) LV045 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6 ) 

7 ) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS; 
TAL: 
AO A: 
ATO: 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4220 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


C [NA ] 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 


EFFECTS/RATIONALE: 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. THE FAILURE IS DETECTED OVER A PERIOD 
OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-71 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/07/86 

EPG 

270 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: H2 FILL GSE SUPPLY T-0 QUICK DISCONNECT (1) PD035 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDXNG/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ l 3 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0012-0210 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE : 

THE H2 GSE SUPPLY T-0 QD HAS NO CAP AND ITS ONLY BACKUP IS THE 
GSE SUPPLY VALVE. AN EXTERNAL LEAK COULD ONLY OCCUR IF THE VALVE 
ALSO LEAKED, BUT IF BOTH LEAKED, COULD LOSE ALL REACTANT. A LEAK 
COULD BE ISOLATED BY USING LV041 BUT PROBABLY FUEL CELL 2 
WOULD BE SHUT DOWN. 


REFERENCES : 


REPORT DATE 12/03/86 


C-72 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/07/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/3 

MDAC ID: 271 ABORT: 3/3 

ITEM: H2 FILL GSE SUPPLY T-0 QUICK DISCONNECT (1) PD03 5 

FAILURE MODE: INABILITY TO MATE/DEMATE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULE 2 

5) 

6) 

7) 

8 ) 

9 > 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0012-0210 


CAUSES: CORROSION, BINDING, DEBRIS 

EFFECTS/RATIONALE : 

IF QD CANNOT MATE OR DEMATE AT LAUNCH PAD, THE MISSION WILL BE 
DELAYED. NO EFFECT ANY OTHER TIMES. 


REFERENCES : 


REPORT DATE 12/03/86 


C-73 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
2/1R 
2/1R 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/07/86 

EPG 

272 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 CHECK VALVE (1) CV010 

FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

CV010 CHECKS 02 FLOW INTO TANK 1. HIGHER PRESSURE DOWNSTREAM OF 
CHECK VALVE THAN UPSTREAM WOULD FORCE REACTANT INTO TANK LINE. 
LOWER PRESSURE IN TANK OR LEAK WOULD HAVE TO OCCUR IN ADDITION TO 
CHECK VALVE FAILURE. RESULT COULD BE LOWER CYRO FLOW TO 
FUEL CELLS AND POSSIBLE SHUTDOWN. FAILS SCREEN B BECAUSE NEED A 
TANK LEAK OR RELIEF VALVE FAILED OPEN TO NOTICE. THIS IS 
CRITICALITY 2/XR BECAUSE COMBINED FAILURE OF TANK RELIEF VALVE 
OPEN COULD LOSE VEHICLE DUE TO REACTANT LOSS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-74 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/07/86 

EPG 

273 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 2/1R 


ITEM: 02 CHECK VALVE (1) CV010 

FAILURE MODE: FAILS CLOSED (RESTRICTED FLOW ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


EPG 

PRSD 

OXYGEN DISTRIBUTION 
02 VALVE MODULE 1 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/1R 

RTLS 

LIFTOFF: 

3/1R 

TAL: 

ONORBIT: 

3/1R 

AO A: 

DEORBIT: 

3/1R 

ATO: 

LANDING/ SAFING: 

3/1R 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 



HDW/FUNC 

2/1R 

2/1R 

3/1R 

3/1R 


c [ p ] 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

REACTANT IS UNABLE TO LEAVE TANK. THIS DEPLETES H2 OUT THE 
RELIEF VALVE AND COULD CAUSE FUEL CELL SHUTDOWN. THIS IS 
DETECTABLE FROM THE TANK PRESSURE SENSOR. FAILURE OF RELIEF 
VALVE CLOSED ALSO COULD CAUSE TANK EXPLOSION, IF HEATERS ON IN 
MANUAL MODE OR FAILED ON. 2/1R BECAUSE IF CV010 AND LV011 FAIL 
CLOSED, COULD LOSE OMS PURGE CAPABILITY FOR TAL, AND HELIUM PURGE 
CAPABILITY FOR RTLS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-75 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 1 

5) 


6) 


7) 


8) 


8) 



DATE: 

SUBSYSTEM: 
MDAC ID: 


10/07/86 

EPG 

274 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 CHECK VALVE (1) CV010 
EXTERNAL LEAKAGE 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/S AFING: 

1/1 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: CORROSION, FATIGUE VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

REACTANT LEAKAGE INTO AREA UNDER PAYLOAD BAY COULD CAUSE 
EXPLOSION OR FREEZE OTHER SYSTEMS. LEAK MAY RESULT IN LOW OR NO 
CRYO FLOW INTO FUEL CELLS. THIS IS DETECTABLE FROM TANK QUANTITY 
AND PRESSURE SENSORS AND MANIFOLD PRESSURE SENSORS OVER A PERIOD 
OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-76 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
2/1R 
2/1R 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 1 

5) 


6) 


7) 


8) 


9) 



DATE: 

SUBSYSTEM: 
MDAC ID: 


10/08/86 

EPG 

275 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 SOLENOID GSE SUPPLY VALVE (1) LV015 
FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4100 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV015 CONTROLS GROUND OPERATION FLOW OF FUEL CELL REACTANT. THIS 
IS 3/3 DURING PRELAUNCH BECAUSE VALVE IS OPEN UNTIL T-0. IT IS 
2/1R OTHER PHASES BECAUSE FAILURE OF 02 GSE T-0 QD WOULD CAUSE 02 
LEAK AND POSSIBLE LOSS OF ALL REACTANT. LEAK COULD BE 
ISOLATED BY CLOSING LV011, BUT FUEL CELL 1 AND SUPPLY TO ECLSS 
SYSTEM 1 COULD BE LOST. 


REFERENCES : 


REPORT DATE 12/03/86 


C-77 



INDEPENDENT ORBXTER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/3 
3/3 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/08/86 

EPG 

276 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 SOLENOID GSE SUPPLY VALVE (1) LV015 
FAILS CLOSED 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDXNG/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4100 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

VALVE IS NORMALLY CLOSED, EXCEPT FOR BEFORE T-0. FAILURE 
PRELAUNCH WOULD CAUSE LAUNCH DELAY, AND POSSIBLE BACKPRESSURE IN 
GSE SUPPLY LINE. 


REFERENCES: 


REPORT DATE 12/03/86 


C-78 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/08/86 

SUBSYSTEM: EPG 

MDAC ID: 277 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: 02 SOLENOID GSE SUPPLY VALVE (1) LV015 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 1 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4100 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 

EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. FAILURE MIGHT BE DETECTED BY MANIFOLD 
PRESSURE SENSOR, ALSO OVER A PERIOD OF TIME FROM CONSOLE QUANTITY 
CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-79 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

278 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 SOLENOID ECLSS SYSTEM 1 SUPPLY VALVE (1) LV012 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 1 

5) 


6) 


7) 


3) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

2/1R 


REDUNDANCY SCREENS: 

A C i ] 

B [ P ] 

C [ P 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4101 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

VALVE IS NORMALLY OPEN. LV012 AND LV022 SUPPLY BREATHABLE OXYGEN 
TO THE CREW. FAILURE COULD PREVENT CREW FROM ISOLATING LOW 
PRESSURE DOWNSTREAM, AND STOPPING POSSIBLE EXPLOSION OR FREEZING 
OF OTHER SYSTEMS. 


REFERENCES : 


REPORT DATE 12/03/86 


C“80 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

279 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 SOLENOID ECLSS SYSTEM 1 SUPPLY VALVE (1) LV012 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


EPG 

PRSD 

OXYGEN DISTRIBUTION 
02 VALVE MODULE 1 



CRITICALITIES 

FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

2/1R 

TAL: 

ONORBIT: 

2/1R 

AO A: 

DEORBIT: 

2/1R 

ATO: 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: A [ 1 ] B [ P ] 


HDW/FUNC 

2/1R 

2/1R 

2/1R 

2/1R 


C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4101 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

IF BOTH LV012 AND LV022 ARE FAILED CLOSED, THE CREW WILL NOT BE 
ABLE TO BREATHE FOR LONG. FAILURE IS DETECTABLE BY FLOW METERS 
AND PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-81 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

280 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: 02 SOLENOID ECLSS SYSTEM 1 SUPPLY VALVE (1) LV012 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4101 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 
EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. FAILURE IS DETECTABLE OVER PERIOD OF 
TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-82 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

281 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 SOLENOID ECLSS SYSTEM 2 SUPPLY VALVE (1) LV022 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

2/1R 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P 3 

c C p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 8 4 -04 2 9-4 101 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

VALVE IS NORMALLY OPEN. LV022 AND LV012 SUPPLY BREATHABLE OXYGEN 
TO THE CREW. FAILURE COULD PREVENT CREW FROM ISOLATING LOW 
PRESSURE DOWNSTREAM AND STOPPING POSSIBLE EXPLOSION OR FREEZING 
OF OTHER SYSTEMS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-83 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

282 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 SOLENOID ECLSS SYSTEM 2 SUPPLY VALVE (1) LV022 

FAILURE MODES FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 


7 ) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

' ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4101 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

IF BOTH LV012 AND LV022 ARE FAILED CLOSED, THE CREW WILL NOT BE 
ABLE TO BREATHE FOR LONG. FAILURE IS DETECTABLE BY FLOW METERS 
AND PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-84 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

283 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: 02 SOLENOID ECLSS SYSTEM 2 SUPPLY VALVE (1) LV022 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 
LANDING/ SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4101 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 


EFFECTS/RATIONALE : 

EXTERNAL LEAK INTO AREA UNDER THE PAYLOAD BAY COULD CAUSE 
EXPLOSION AND FREEZE OTHER SYSTEMS. A LEAK IS DETECTABLE OVER A 
PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-85 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

284 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: 02 FILL GSE SUPPLY T-0 QUICK DISCONNECT (1) PD015 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYSTS S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C[P] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0012-0110 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE : 

THE 02 GSE SUPPLY T-0 QD HAS NO CAP AND ITS ONLY BACKUP IS THE 02 
GSE SUPPLY VALVE TO PREVENT LEAKS. A LEAK COULD BE ISOLATED BY 
LV015, LV011, AND LV021 IN ORDER. A LEAK IS DETECTABLE OVER A 
PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C~86 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/10/86 

EPG 

285 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 FILL GSE SUPPLY T-0 QUICK DISCONNECT (1) PD015 

FAILURE MODE: INABILITY TO MATE/DEMATE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/ SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0012-0110 


CAUSES: CORROSION, BINDING, DEBRIS 

EFFECTS/RATIONALE : 

IF THE QD CANNOT MATE ON THE PAD, THE FUEL CELLS CANNOT USE 
GROUND REACTANT. IF QD CANNOT DEMATE, THE MISSION WILL BE 
DELAYED. NO EFFECT ANY OTHER TIMES. 


REFERENCES : 


REPORT DATE 12/03/86 


C-87 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/14/86 

EPG 

286 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 MANIFOLD PRESSURE SENSOR (2) 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: ME 449-0177-2503 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

MANIFOLD 1 SENSOR MEASURES PRESSURE BETWEEN TANK 1 CHECK VALVE, 
ECLSS SYSTEM 1 SUPPLY VALVE, FUEL CELL 1 SUPPLY VALVE, MANIFOLD 1 
RELIEF VALVE, 02 GSE SUPPLY VALVE, AND THE MANIFOLD 1 CROSSOVER 
VALVE. MANIFOLD 2 SENSOR MEASURES PRESSURE BETWEEN TANK 2 
CHECK VALVE, MANIFOLD 2 CROSSOVER VALVE, FUEL CELL 2 SUPPLY 
VALVE, ECLSS SYSTEM 2 SUPPLY VALVE, AND MANIFOLD 2 RELIEF VALVE. 
THESE SENSORS HAVE NO EFFECT ON OTHER COMPONENTS. MANIFOLD 
RELIEF VALVES WOULD DISSIPATE EXCESS PRESSURE. 

CREW WOULD MAKE SURE ALL VALVES ARE OPEN TO FUEL CELLS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-88 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/14/86 


HIGHEST 

CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 



FLIGHT: 

3/3 

MDAC ID: 

287 



ABORT: 

3/3 

ITEM: 

02 MANIFOLD 

PRESSURE 

SENSOR 

(2) 


FAILURE MODE 

!: ZERO OUTPUT 





LEAD ANALYST 

: S. GOTCH 

SUBSYS 

LEAD: M 

. HIOTT 



BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: ME449-0177-2503 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 


EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE THE CREW TO CHECK FUEL CELL FLOW METERS 
AND TANK PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-89 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/14/86 

HIGHEST 

CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 


FLIGHT: 

3/3 

MDAC ID: 

288 


ABORT: 

3/3 

ITEM: 

02 MANIFOLD 

PRESSURE SENSOR 

(2) 



FAILURE MODE: OUT OF TOLERANCE ft 

1 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT t 


BREAKDOWN HIERARCHY: f 


1) 

EPG 

I 

2) 

PRSD 


3) 

OXYGEN DISTRIBUTION 


4) 

02 VALVE MODULE 1 

g 

| 

5) 


& 

6) 



7) 


r 

8) 


'i 

8) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

3/3 


LIFTOFF: 

3/3 

TAL: 

3/3 

i 

s 

ONORBIT: 

3/3 

AO A: 

3/3 

el 

ty 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

h 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA 3 



LOCATION: MID FUSELAGE 

PART NUMBER: ME449-0177-2503 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

AN INACCURATE READING MAY CAUSE THE CREW TO CHECK FUEL CELL 
FLOWMETER AND TANK PRESSURE SENSORS. 


REFERENCES : 


i 


(i 


REPORT DATE 12/03/86 


C-90 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/14/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 2/1R 

MDAC ID: 289 ABORT: 2/1R 

ITEM: 02 FUEL CELL 1 SOLENOID REACTANT SUPPLY VALVE (1) 

LV013 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

2/1R 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4102 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV013 IS USED TO CONTROL 02 FLOW INTO FUEL CELL 1. IF FUEL CELL 
1 IS SHUTDOWN, VALVE WOULD NEED TO BE CLOSED OR COULD LOSE 
VEHICLE. COULD USE LV011 AND LV021 IF NEEDED TO ISOLATE FUEL 
CELL, BUT COULD NOT STOP REACTANT FLOW. 


REFERENCES : 


REPORT DATE 12/03/86 


C-91 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/14/86 

EPG 

290 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 1/1 


ITEM: 02 FUEL CELL 1 SOLENOID REACTANT SUPPLY VALVE (1) 

LV0X3 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1 ) 

EPG 

2) 

PRSD 

3 ) 

OXYGEN DISTRIBUTION 

4 ) 

02 VALVE MODULE 1 

5 ) 


6 ) 


7 ) 


8 ) 


9 ) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

2/1R 

TAL: 

1/1 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

3/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4102 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

THE CRITICALITY IS 2/1R FOR ASCENT AND ATO/AOA ABORTS BECAUSE IF 
2 FUEL CELL REACTANT VALVES FAIL, THEN ORBITER IS LOST. THE 
EARLIEST AN ORBITER CAN OPERATE ON ONLY 1 FUEL CELL IS AFTER 
MECO. CAN DETECT FAILURE BY USING FUEL CELL FLOWMETER. 1/1 FOR 
TAL ABORT BECAUSE FUEL SHUTDOWN LOSES OMS PURGE CAPABILITY. 1/1 
FOR RTLS BECAUSE HELIUM PURGE CAPABILITY WOULD BE LOST. FAILURE 
ONORBIT CAUSES PRIORITY FLIGHT DECISION. 


REFERENCES : 


REPORT DATE 12/03/86 


C-92 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/14/86 

EPG 

291 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: 02 FUEL CELL 1 SOLENOID REACTANT SUPPLY VALVE (1) 

LV013 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

EPG 

2) 

PRSD 

3 ) 

OXYGEN DISTRIBUTION 

4 ) 

02 VALVE MODULE 1 

5 ) 


6 ) 


7 ) 


8 ) 


9 ) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4102 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

02 LEAKING INTO AREA UNDER THE PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. A LEAK MAY PREVENT THE FUEL CELL FROM 
RECEIVING ADEQUATE REACTANT. THE FAILURE IS DETECTABLE OVER A 
PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-93 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/15/86 

EPG 

292 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 MANIFOLD 1 SOLENOID CROSSOVER VALVE (1) LV011 

FAILURE MODE: FAILS OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 1 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P 3 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4110 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV011 IS USED TO ISOLATE 02 FLOW FROM TANK 1 AND VALVE MODULE 1 
(FUEL CELL 1 AND ECLSS SYSTEM 1) FROM THE OTHER FUEL CELLS AND 
TANKS. IF THERE IS A LOW PRESSURE PROBLEM IN VALVE MODULE 1, 
LV021 WOULD NEED TO BE CLOSED TO PREVENT LOSS OF ALL REACTANT. 
TANK 1 RELIEF VALVE AND MANIFOLD 1 RELIEF VALVE WOULD HAVE TO 
FAIL OPEN TO LOSE ALL REACTANT. CLOSING LV021 WOULD STILL 
SHUTDOWN FUEL CELLS 1 AND 3. 


REFERENCES : 


REPORT DATE 12/03/86 


C-94 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/15/86 

EPG 

293 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/2R 

ABORT: 2/1R 


ITEM: 02 MANIFOLD 1 SOLENOID CROSSOVER VALVE (1) LV011 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/2R 

TAL: 

2/1R 

ONORBIT: 

3/2R 

AO A: 

3/2R 

DEORBIT: 

LANDING/SAFING: 

3/2R 

3/3 

ATO: 

3/2R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P 3 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 8 4-04 2 9 -4 110 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

2/1R FOR TAL BECAUSE IF TANK 1 RELIEF VALVE FAILS OPEN, COULD 
LOSE FUEL CELL 1 AND OMS PURGE CAPABILITY. 2/1R FOR RTLS BECAUSE 
HELIUM PURGE CAPABILITY WOULD BE LOST. TANK 1 WOULD DEPLETE 
FASTER SINCE IT ALONE COULD FEED FUEL CELL 1 AND ECLSS SYSTEM 1. 
FAILURE IS DETECTABLE FROM VALVE POSITION INDICATOR. 3/2R FOR 
ASCENTS AND OTHER ABORTS IF TANK 1 HAS ITS CHECK VALVE OR FILTER 
CLOSED, OR TANK RELIEF VALVE OPEN. 


REFERENCES : 


REPORT DATE 12/03/86 


C-95 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/15/86 HIGHEST CRITICALITY HDW/FUNC 

1/1 
1/1 

(1) LV011 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 1 

5) 

6 ) 

7) 

8 ) 

9) 


SUBSYSTEM: EPG 

MDAC ID: 294 


FLIGHT: 

ABORT: 


ITEM: 

FAILURE MODE: 


02 MANIFOLD 1 SOLENOID CROSSOVER VALVE 
EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

1/1 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4110 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION AND FREEZE 
OTHER SYSTEMS. IF ONLY LV011 LEAKS, CAN USE LV021 TO ISOLATE 
LEAK, BUT MAY LOSE FUEL CELLS 1 AND 3. IF BOTH CROSSOVER VALVES 
LEAK, MAY CAUSE ALL FUEL CELLS TO BE SHUTDOWN. FAILURE IS 
DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-96 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/15/86 

EPG 

295 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 MANIFOLD 2 SOLENOID CROSSOVER VALVE (1) LV021 

FAILURE MODE: FAILS OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2) 

3) 

4) 

5) 

6) 

7) 

8 ) 
9 ) 


EPG 

PRSD 

OXYGEN DISTRIBUTION 
02 VALVE MODULE 2 



CRITICALITIES 

FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/1R 

TAL: 

ONORBIT: 

3/1R 

AO A: 

DEORBIT: 

3/1R 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 


REDUNDANCY SCREENS: A [ 1 ] B [ P ] C[P] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4110 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

LV021 IS USED TO ISOLATE 0 2 FLOW FROM TANK 2 AND VALVE MODULE 2 
(FUEL CELL 2 AND ECLSS SYSTEM 2) FROM THE OTHER FUEL CELLS AND 
TANKS. IF THERE IS A LOW PRESSURE PROBLEM IN VALVE MODULE 2, 
LV Oil WOULD HAVE TO BE CLOSED TO PREVENT LOSS OF ALL REACTANT. 
TANK 2 RELIEF VALVE AND MANIFOLD 2 RELIEF VALVE WOULD HAVE TO 
FAIL OPEN TO LOSE ALL REACTANT. CLOSING LV011 WOULD STILL 
SHUTDOWN FUEL CELLS 2 AND 3. 


REFERENCES : 


REPORT DATE 12/03/86 


C-97 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


| 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/15/86 

EPG 

296 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/2R 

ABORT: 3/2R 


ITEM: 02 MANIFOLD 2 SOLENOID CROSSOVER VALVE (1) LV021 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


£ 




f 

£ 

* 


BREAKDOWN HIERARCHY: 


1) 

EPG 

V 

2) 

PRSD 

{' 

3) 

OXYGEN DISTRIBUTION 

S' 

4) 

02 VALVE MODULE 2 

if 

5) 

6) 


fi- 

1' 

7) 


| 

8) 


b. 

9) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/2R 

LIFTOFF: 

3/2R 

TAL: 

3/2R 

ONORBIT: 

3/2R 

AO A: 

3/2R 

DEORBIT: 

3/2R 

ATO: 

3/2R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A c 1 3 

B C P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284“0429~4110 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

THE CRITICALITY IS 3/2R IF TANK 2 RELIEF VALVE FAILS OPEN OR 
CHECK VALVE FAILS CLOSED. TANK 2 WOULD DEPLETE FASTER SINCE IT 
ALONE COULD FEED FUEL CELL 2 AND ECLSS SYSTEM 2. FAILURE IS 
DETECTABLE FROM VALVE POSITION INDICATOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C~98 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/15/86 

EPG 

297 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: 02 MANIFOLD 2 SOLENOID CROSSOVER VALVE (1) LV021 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5) 

6 ) 

7) 

8) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4110 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

LEAK INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION AND FREEZE 
OTHER SYSTEMS. IF ONLY LV021 LEAKS, CAN USE LV011 TO ISOLATE 
LEAK, BUT MAY LOSE FUEL CELLS 3 AND 2 AND ECLSS SYSTEM 2. IF 
BOTH CROSSOVER VALVES LEAK, MAY CAUSE ALL FUEL CELLS TO BE 
SHUT DOWN. FAILURE IS DETECTABLE OVER A PERIOD OF TIME FROM 
CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-99 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

298 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 HORIZONTAL DRAIN QD (1) 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0180 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE : 

THE HORIZONTAL DRAIN IS USED AFTER LANDING TO DRAIN REMAINING 
REACTANT FROM PRSD. A CAP PROVIDES A LEVEL OF REDUNDANCY. IF QD 
AND CAP BOTH LEAK, LOSS OF ALL REACTANT COULD OCCUR, POSSIBLY 
CAUSING FUEL CELL AND ECLSS SYSTEMS SHUTDOWN. CANNOT DETECT 
LOSS OF QD ALONE. 


REFERENCES : 


REPORT DATE 12/03/86 


C-100 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

299 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 HORIZONTAL DRAIN QD (1) 

FAILURE MODE: INABILITY TO MATE/DEMATE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


EPG 

PRSD 

OXYGEN DISTRIBUTION 
02 VALVE MODULE 2 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0180 


CAUSES: CORROSION, BINDING, DEBRIS 

EFFECTS/RATIONALE : 

THE DRAIN QD IS NOT USED AT LAUNCH PAD. THERE IS NO EFFECT AFTER 
LANDING BECAUSE THE MISSION HAS ALREADY ENDED AND CAN DRAIN 02 
THROUGH FILL QD. 


REFERENCES : 


REPORT DATE 12/03/86 


C-101 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

300 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 HORIZONTAL DRAIN CAP (1) 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBITS 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC 276-0010-0160 


CAUSES: CONTAMINATION, FATIGUE, CORROSION 

EFFECTS/RATIONALE : 

THE CAP IS A LEVEL OF REDUNDANCY OVER QD. REACTANT CANNOT LEAK 
OUT UNLESS QD ALSO LEAKS. IF BOTH CAP AND QD LEAK, COULD LOSE ALL 
02. CANNOT DETECT LOSS OF CAP. 


REFERENCES : 


REPORT DATE 12/03/86 


C-102 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

301 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: 02 FUEL CELL 3 SOLENOID REACTANT SUPPLY VALVE (1) 

LV024 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

2/1R 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 8 4 -042 9-4 103 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

LV024 IS USED TO CONTROL 02 FLOW INTO FUEL CELL 3. IF FUEL CELL 
3 IS SHUT DOWN, VALVE WOULD NEED TO BE CLOSED OR COULD LOSE 
VEHICLE. LV021 OR LV011 COULD BE USED TO ISOLATE FUEL CELL, BUT 
COULD NOT STOP REACTANT FLOW. 


REFERENCES : 


REPORT DATE 12/03/86 


C-103 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

302 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: 02 FUEL CELL 3 SOLENOID REACTANT SUPPLY VALVE (1) 

LV024 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 

~ 

7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AOA: 

2/1R 

DEORBIT: 

3/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ P 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 84-042 9-4103 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

THE CRITICALITY IS 2/1R FOR ASCENT AND ABORTS BECAUSE IF 2 FUEL 
CELL REACTANT VALVES FAIL, THEN ORBITER IS LOST. THE EARLIEST AN 
ORBITER CAN OPERATE ON ONLY 1 FUEL CELL IS AFTER MECO. CAN DETECT 
FAILURE USING FUEL CELL FLOWMETER. 

FAILURE ONORBIT CAUSES PRIORITY FLIGHT DECISION. 


REFERENCES : 


REPORT DATE 12/04/86 BTK 


C-104 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

303 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: 02 FUEL CELL 3 SOLENOID REACTANT SUPPLY VALVE (1) 

LV024 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 
LANDING/ SAFING: 

1/1 

1/1 

ATO; 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4103 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

02 LEAKING INTO AREA UNDER THE PAYLOAD BAY COULD CAUSE EXPLOSION 
AND FREEZE OTHER SYSTEMS. A LEAK MAY PREVENT FUEL CELL FROM 
RECEIVING ADEQUATE REACTANT. A FAILURE IS DETECTABLE OVER A 
PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-105 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/16/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 2/1R 

MDAC ID: 3 04 ABORT: 2/1R 

ITEM: 02 FUEL CELL 2 SOLENOID REACTANT SUPPLY VALVE (1) 

LV023 

FAILURE MODE: FAILS OPEN (INCLUDES INTERNAL LEAKAGE) 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5) 

6 ) 

7) 

8) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

2/1R 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: . 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

2/1R 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4X02 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 

EFFECTS/RATIONALE : 

LV023 IS USED TO CONTROL 02 FLOW INTO FUEL CELL 2. IF FUEL CELL 
2 IS SHUT DOWN, VALVE WOULD NEED TO BE CLOSED OR COULD LOSE 
VEHICLE. COULD USE LV021 OR LV011 TO ISOLATE FUEL CELL, BUT 
COULD NOT STOP REACTANT FLOW. 


REFERENCES : 


& 

ff 


REPORT DATE 12/03/86 


C”106 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

305 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 FUEL CELL 2 SOLENOID REACTANT SUPPLY VALVE (1) 

LV023 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULE 2 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

2/1R 

TAL: 

ONORBIT: 

2/1R 

AO A: 

DEORBIT: 

3/1R 

ATO: 

LANDING/ SAFING: 

3/3 


REDUNDANCY SCREENS: 

A c l 3 

B [ P ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4102 



HDW/FUNC 

2/1R 

2/1R 

2/1R 

2/1R 


C [ P ] 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE, LOSS OF ELECTRICAL SIGNAL 


EFFECTS/RATIONALE : 

THIS IS CRITICALITY 2/1R FOR ASCENT AND ABORTS BECAUSE IF 2 FUEL 
CELL REACTANT VALVES FAIL, THEN ORBITER IS LOST. THE EARLIEST AN 
ORBITER CAN OPERATE ON ONLY 1 FUEL CELL IS AFTER MECO. CAN 
DETECT FAILURE USING FUEL CELL FLOWMETER. 

FAILURE ONORBIT CAUSES PRIORITY FLIGHT DECISION. 


REFERENCES : 


REPORT DATE 12/03/86 


C-107 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/16/86 

SUBSYSTEM: EPG 

MDAC ID: 306 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


02 FUEL CELL 2 SOLENOID REACTANT SUPPLY VALVE (1) 


ITEM: 02 FUEL CELL 2 S 

LV023 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5 ) 

6 ) 

7) 

8 ) 

9 ) 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


REDUNDANCY SCREENS: A [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0429-4102 


B [NA ] 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


C [NA ] 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE s 

02 LEAKING INTO AREA UNDER PAYLOAD BAY COULD CAUSE EXPLOSION AND 
FREEZE OTHER SYSTEMS. A LEAK MAY PREVENT FUEL CELL FROM 
RECEIVING ADEQUATE REACTANT. A FAILURE IS DETECTABLE OVER A 
PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-108 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

307 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 MANIFOLD 1 RELIEF VALVE (1) RV011 

FAILURE MODE: FAILED OPEN (ALSO INTERNAL LEAKAGE) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/1 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0003 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

LOSS OF RVOll BY ITSELF AND COMBINED WITH LOSS OF RV021 WOULD 
HAVE NO EFFECT. IF TANK 1 RELIEF VALVE ALSO FAILED OPEN COULD 
LOSE ALL REACTANT, THUS 2/1R. NEED FAILURE UPSTREAM ALSO TO 
DETECT WITH MANIFOLD 1 PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-109 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/16/86 


HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 



FLIGHT: 

3/1R 

MDAC ID: 

308 



ABORT: 

3/1R 

ITEM: 

02 MANIFOLD 1 

RELIEF 

VALVE (1) 

RV011 


FAILURE MODE 

: FAILS CLOSED 





LEAD ANALYST 

: S. GOTCH 

SUBSYS 

LEAD: M. 

HIOTT 



BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/1R 


REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATIONS MID FUSELAGE 

PART NUMBER: MC284-0440-0003 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

A PRESSURE BUILDUP AND POSSIBLE LINE RUPTURE COULD RESULT IF BOTH 
RV011 AND RV021 WERE CLOSED. THE CAUSE OF AN EXCESSIVE PRESSURE 
BUILDUP WOULD BE TANK HEATERS FAILED ON. IT IS CRITICALITY 3/1R 
IF A TANK’S HEATERS FAIL ON AND ITS TANK RELIEF VALVE 
FAILS CLOSED. THIS IS DETECTABLE FROM THE MANIFOLD PRESSURE 
SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-110 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9 ) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

EPG 

309 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 MANIFOLD 1 RELIEF VALVE (1) RV011 
EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0003 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 

EFFECTS/RATIONALE : 

THIS IS CRITICALITY 1/1 BECAUSE A LEAK COULD CAUSE POSSIBLE 
EXPLOSION OR FREEZING UNDER PAYLOAD BAY. A LEAK IS DETECTABLE 
OVER A PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-lll 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


t 


DATE: 

10/17/86 


HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

EPG 


FLIGHT: 

2/1R 

MDAC ID: 

310 


ABORT: 

2/1R 

ITEM: 

02 MANIFOLD 

2 RELIEF 

VALVE (1) RV021 


FAILURE MODE 

!: FAILED OPEN 

(ALSO INTERNAL LEAKAGE) 


LEAD ANALYST 

: S. GOTCH 

SUBSYS 

LEAD: M. HIOTT 



BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c [ P 3 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0003 




i 

% 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

LOSS OF RV021 BY ITSELF OR COMBINED WITH RV011 WOULD HAVE NO 
EFFECT. IF TANK 2 RELIEF VALVE ALSO FAILED OPEN, COULD LOSE ALL 
REACTANT, THUS 2/1R. NEED FAILURE UPSTREAM TO DETECT WITH 
MANIFOLD 2 PRESSURE SENSOR. 

THE FUNCTION OF THE VALVE IS PRESSURE CONTROL OF THE MANIFOLD. 


REFERENCES s 


REPORT DATE 12/03/86 


C-I12 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/17/86 

EPG 

311 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 MANIFOLD 2 RELIEF VALVE (1) RV021 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 

ONORBTT : 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 
HDW/FUNC ABORT 


3/1R 

3/1R 

3/1R 

3/1R 

3/1R 


RTLS: 
TAL: 
AO A: 
ATO: 


REDUNDANCY SCREENS: A [ 1 ] B [ P ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0003 


HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 


c [ p ] 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

A PRESSURE BUILDUP AND POSSIBLE LINE RUPTURE COULD RESULT IF BOTH 
RV011 AND RV021 WERE CLOSED. THIS FAILURE IS DETECTABLE FROM THE 
MANIFOLD PRESSURE SENSOR. THE CRITICALITY IS 3/1R IF A TANK'S 
HEATERS FAIL ON AND ITS TANK RELIEF VALVE FAILS CLOSED. 


REFERENCES : 


REPORT DATE 12/03/86 


C-113 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


r 

f 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/17/86 

EPG 

312 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: 02 MANIFOLD 2 RELIEF VALVE (1) RV021 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


f 


BREAKDOWN HIERARCHY: 


1 ) 

EPG 

t 

fc 

2) 

PRSD 

3 ) 

OXYGEN DISTRIBUTION 


4 ) 

02 RELIEF VALVE/FILTER PACKAGES 

& 

5 ) 


l 

6 ) 



7 ) 


l 

8 ) 



9 ) 




CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0003 


CAUSES: VIBRATION, CORROSION, FATIGUE, CONTAMINATION 

EFFECTS/RATIONALE : 

A LEAK COULD CAUSE POSSIBLE EXPLOSION OR FREEZING UNDER PAYLOAD 
BAY. A LEAK IS DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE 
QUANTITY CHARTS. 


REFERENCES : 


i 


is 


REPORT DATE 12/03/86 


C-114 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/17/86 

EPG 

313 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 CHECK VALVE (2) CV021 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9 ) 


EPG 

PRSD 

OXYGEN DISTRIBUTION 

02 RELIEF VALVE/FILTER PACKAGES 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

CV021 CHECKS FLOW INTO TANK 3 AND THE OTHER CHECK VALVE CHECKS 
FLOW INTO TANKS 4 AND 5. HIGHER PRESSURE DOWNSTREAM OF CHECK 
VALVE THAN UPSTREAM WOULD FORCE REACTANT INTO TANK. LOW PRESSURE 
IN TANK OR LEAK WOULD HAVE TO OCCUR IN ADDITION TO CHECK 
VALVE FAILURE. RESULT COULD BE LOWER CYRO FLOW TO FUEL CELLS AND 
POSSIBLE SHUTDOWN. FAILS SCEEN B BECAUSE NEED A TANK LEAK OR 
RELIEF VALVE FAILED OPEN TO DETECT. THIS IS 2/1R BECAUSE 
COMBINED FAILURE OF TANK LEAK OR RELIEF VALVE STUCK OPEN COULD 
DEPLETE ALL 02. 

REFERENCES : 


REPORT DATE 12/03/86 


C-115 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/17/86 

EPG 

314 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 CHECK VALVE (2) CV021 

FAILS CLOSED (RESTRICTED FLOW ALSO) 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/ SAFING: 

3/1R 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

REACTANT UNABLE TO LEAVE TANK-THIS DEPLETES H2 OUT THE RELIEF 
VALVE AND COULD CAUSE FUEL CELL SHUTDOWN. FAILURE OF RELIEF 
VALVE ALSO COULD CAUSE TANK EXPLOSION, IF THE HEATER IS ON IN 
MANUAL MODE OR FAILED ON. 

THIS IS DETECTABLE FROM TANK PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-116 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/17/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG PLIGHT: 1/1 

MDAC ID: 315 ABORT: 1/1 

ITEM: 02 CHECK VALVE (2) CV021 

FAILURE MODE: EXTERNAL LEAKAGE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 
LANDING/S AFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

REACTANT LEAK INTO AREA UNDER THE PAYLOAD BAY COULD CAUSE 
EXPLOSION OR FREEZE OTHER SYSTEMS. MAY RESULT IN LOW OR NO 02 
FLOW INTO FUEL CELLS. THIS IS DETECTABLE FROM TANK QUANTITY 
SENSORS AND CONSOLE QUANTITY CHARTS OVER A PERIOD OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-117 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 

ITEM: 02 LINES, COMPONENTS, & FITTINGS 

FAILURE MODE: EXTERNAL LEAKAGE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

316 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


BREAKDOWN HIERARCHY: 


1) 

EPG 




2) 

PRSD 




3) 

OXYGEN STORAGE 




4) 





5) 





6) 





*) 





8) 





9) 







CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

1/1 

RTLS: 

1/1 


LIFTOFF: 

1/1 

TAL: 

1/1 


ONORBIT: 

1/1 

AO A: 

1/1 


DEORBIT: 

1/1 

ATO: 

1/1 


LANDING/SAFING: 

1/1 




REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: V070-454898 


CAUSES: SHOCK, VIBRATION, FATIGUE, OVERPRESSURE, BRITTLENESS DUE 

TO TEMPERATURE. 


EFFECTS/RATIONALE : 

THIS IS CRITICALITY 1/1 BECAUSE ALL REACTANT COULD DEPLETE AND 
CAUSE FUEL CELL SHUTDOWN? ALSO LEAK COULD CAUSE 02 TO FREEZE 
OTHER SYSTEMS UNDER THE PAYLOAD BAY AND ALSO CAUSE EXPLOSION. 
THIS IS DETECTABLE FROM TANK QUANTITY SENSORS AND CONSOLE 
QUANTITY SENSORS OVER A PERIOD OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-118 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

317 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 1/1 


ITEM: 02 LINES , COMPONENTS, & FITTINGS 

FAILURE MODE: RESTRICTED FLOW 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 

5) 

6 ) 

7) 

3) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

2/1R 

TAL: 

1/1 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P 3 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: V070-454898 


CAUSES: CONTAMINATION, DEBRIS 

EFFECTS/RATIONALE : 

RESTRICTED FLOW COULD CAUSE NO REACTANT TO REACH FUEL CELL, AND 
THUS CAUSE THEM TO BE SHUTDOWN. THIS IS 1/1 FOR TAL IF BLOCKAGE 
AFFECTS FUEL CELL 1 BECAUSE IT WOULD CAUSE LOSS OF OMS PURGE 
CAPABILITY. ALSO 1/1 FOR RTLS BECAUSE SAME BLOCKAGE WOULD 
CAUSE LOSS OF HELIUM PURGE CAPABILITY. FAILURE ONORBIT CAUSES 
PRIORITY FLIGHT DECISION. OVERPRESSURE COULD BE VENTED OUT TANK 
OR MANIFOLD RELIEF VALVES. THIS IS DETECTABLE FROM TANK PRESSURE 
SENSORS OR FUEL CELL FLOW METERS. 2/1R FOR ASCENT AND OTHER 
ABORTS BECAUSE BLOCKAGE TO 2 FUEL CELLS WOULD LOSE VEHICLE. 


REFERENCES: 


REPORT DATE 12/03/86 


C-119 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

318 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK QUANTITY SENSOR (5) V45Q11 (-5) 05A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

SENSOR FAILURE HAS NO EFFECT ON HEATER OPERATION. SENSOR FAILURE 
CANNOT BE VERIFIED BY LOOKING AT OTHER INSTRUMENTATION. CREW 
WOULD ONLY KNOW THAT TANK CANNOT ALWAYS BE FULL. CREW MIGHT BE 
ABLE TO FIGURE OUT APPROXIMATE QUANTITY BY TURNING HEATERS ON 
FOR A CERTAIN TIME AND MEASURE CORRESPONDING FLUID TEMPERATURE OR 
PRESSURE RISE. 


REFERENCES : 


REPORT DATE 12/03/86 


C-120 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

319 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK QUANTITY SENSOR (5) V45Qll(-5) 05A 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/S AFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD HAVE NO AUTOMATIC EFFECT ON HEATERS. ZERO 
OUTPUT WOULD CAUSE CREW TO WANT TO TURN HEATERS OFF. 


REFERENCES : 


REPORT DATE 12/03/86 


C-121 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

320 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK QUANTITY SENSOR (5) V45Q11 (-5) 05A 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 82-0063 -0100 

CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 


EFFECTS/RATIONALE : 

AN INACCURATE READING MAY CAUSE THE CREW TO CHANGE TANK 
MANAGEMENT SCHEME. CREW COULD OPERATE TANK MISTAKENLY BELOW ITS 
REDLINE LIMIT. 


REFERENCES : 


REPORT DATE 12/03/86 


C-122 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

321 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: 02 TANK FLUID TEMPERATURE SENSORS (5) V45T11(- 

5) 01A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AOA: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA J B [NA ] C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

FAILURE OF SENSOR HAS NO EFFECT ON HEATER OPERATION. FAILURE CAN 
BE DETECTED BY CHECKING HEATER ASSEMBLY TEMPERATURE SENSOR OR 
TANK PRESSURE SENSOR. FULL OUTPUT WOULD CAUSE CREW TO WANT TO 
TURN OFF HEATERS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-123 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

322 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK FLUID TEMPERATURE SENSORS (5) V45T11(- 

5) 01A 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE CREW TO WANT TO TURN HEATERS ON. 


REFERENCES : 


REPORT DATE 12/03/86 


C-124 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

323 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK FLUID TEMPERATURE SENSORS (5) V45T11(- 

5) 01A 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7) 

8) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

INACCURATE READING MAY CAUSE CREW TO WANT TO MANUALLY OPERATE 
HEATERS TO KEEP TEMPERATURE READING WITHIN TOLERANCES. 


REFERENCES : 


REPORT DATE 12/03/86 


C-125 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

324 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK HEATER ASSEMBLY 1 TEMPERATURE SENSOR (5) 

V45T11(-5)07A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

HEATER ASSEMBLY 1 CONSISTS OF HEATERS A1 AND B1 IN EACH 02 TANK. 
IF 5 TANKS FLY, THE B HEATERS IN TANKS 4 AND 5 WILL NOT BE 
OPERATIONAL. THE SENSOR IS ONLY CONNECTED TO A GAUGE; IT DOES 
NOT AFFECT HEATER OPERATION. FULL OUTPUT WOULD CAUSE CREW TO WANT 
TO TURN HEATERS OFF. FAILURE CAN BE DETECTED BY CHECKING TANK 
FLUID TEMPERATURE OR PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-126 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

325 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK HEATER ASSEMBLY 1 TEMPERATURE SENSOR (5) 

V45Tll(-5) 07A 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUB-ASSEMBLY 

6 ) 

7 ) 

8) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 82-0063 -0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE CREW TO WANT TO TURN HEATERS ON. 


REFERENCES : 


REPORT DATE 12/03/86 


C-127 



INDEPENDENT ORBITER ASSESSMENT 
XBITER SUBSYSTEM ANALYSIS WORKSHEET 

L0/20/86 HIGHEST CRITICALITY HDW/FUNC 

PG FLIGHT: 3/3 

26 ABORT: 3/3 

•j 02 TANK HEATER ASSEMBLY 1 TEMPERATURE SENSOR (5) 

4 OUT OF TOLERANCE 

i S. GOTCH SUBSYS LEAD: M. HIOTT 

RARCHY: 


TORAGE 

luB-ASSEMBLY 

3 

-Tj 


CRITICALITIES 


ASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

VCH: 

3/3 

RTLS: 

3/3 

h 

3/3 

TAL: 

3/3 

Cs 

3/3 

AO A: 

3/3 

f: 

3/3 

ATO: 

3/3 

&/SAFING: 

3/3 



Miens: 

A [NA 3 

B [NA ] 

C [NA 3 


3 MID FUSELAGE 
; MC282 -*0063 ~0 100 

AT ION, SHOCK, CORROSION, ELECTRICAL FAILURE 


VALE: 

iDING MAY CAUSE CREW TO WANT TO MANUALLY OPERATE 
3P TEMPERATURE READING WITHIN TOLERANCES. 


j 

'3 


mmmM pmqe m 


1 / 03/86 


C-X28 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID; 


10 / 20/86 

EPG 

327 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK HEATER ASSEMBLY 2 TEMPERATURE SENSOR (5) 

V45Tll(-5) 09A 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

HEATER ASSEMBLY 2 CONSISTS OF HEATERS A2 AND B2 IN EACH 02 TANK. 
IF 5 TANKS FLY, THE B HEATERS IN TANKS 4 AND 5 WILL NOT BE 
OPERATIONAL. THE SENSOR IS ONLY CONNECTED TO A GAUGE? IT DOES 
NOT AFFECT HEATER OPERATION. 

FULL OUTPUT WOULD CAUSE CREW TO WANT TO TURN THE HEATERS OFF. 
FAILURE CAN BE DETECTED BY CHECKING TANK FLUID TEMPERATURE OR 
PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-129 



INDEPENDENT ORB I TER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/20/86 

HIGHEST CRITICALITY 

HDW/FUNC 

a 

SUBSYSTEM: EPG 

FLIGHT: 

3/3 


MDAC 

ID: 328 

ABORT: 

3/3 

r* 

t 

ITEM: 

02 TANK HEATER 

ASSEMBLY 2 TEMPERATURE SENSOR (5) 

t 

V45Tll(-5) 09A 

FAILURE MODE: ZERO OUTPUT 



1 

LEAD 

ANALYST: S. GOTCH 

SUBSYS LEAD: M. HIOTT 


L'i 

BREAKDOWN HIERARCHY: 



F- 

1 

1) 

EPG 




2) 

PRSD 



1 

3) 

OXYGEN STORAGE 



4) 

02 TANKS 



h 

5) 

02 TANK SUBASSEMBLY 




6) 




f; 

7) 




s,. 

8) 





9 ) 






CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 

CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE CREW TO WANT TO TURN HEATERS ON. 


REFERENCES : 


REPORT DATE 12/03/86 


C-130 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

329 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK HEATER ASSEMBLY 2 TEMPERATURE SENSOR (5) 

V45Tll(-5) 09A 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, SHOCK, CORROSION, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

INACCURATE READING MAY CAUSE CREW TO WANT TO MANUALLY OPERATE 
HEATERS TO KEEP TEMPERATURE READING WITHIN TOLERANCES. 


REFERENCES : 


REPORT DATE 12/03/86 


C-131 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

330 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: 


02 TANK SUBASSEMBLY (5) 


FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 




r 

2) 

PRSD 





3 ) 

OXYGEN STORAGE 





4) 

02 TANKS 




f' 

5) 






6) 






7) 





P 

8 ) 





l 

9 ) 








CRITICALITIES 


{ 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

,J 


PRELAUNCH: 

1/1 

RTLS: 

1/1 



LIFTOFF: 

1/1 

TAL: 

1/1 

P 


ONORBIT: 

1/1 

AO A: 

1/1 

y* 


DEORBIT: 

1/1 

ATO: 

1/1 



LANDING/SAFING: 

1/1 



i 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 

i 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: CORROSION, FATIGUE, TEMPERATURE, POROSITY, 

OVERPRESSURIZATION 

EFFECTS/RATIONALE : 

LEAK IN TANK COULD CAUSE 02 TO FREEZE OTHER SYSTEMS UNDER PAYLOAD 
BAY AND ALSO CAUSE EXPLOSION. 02 COULD BE DEPLETED. THIS IS 
DETECTABLE THROUGH QUANTITY SENSORS AND CONSOLE CHARTS OVER A 
PERIOD OF TIME. 


REFERENCES : 


i 


REPORT DATE 12/03/86 


C-132 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

331 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: 02 TANK SUBASSEMBLY (5) 

FAILURE MODE: RUPTURE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN STORAGE 

4) 

02 TANKS 

5) 


6) 


7) 


8) 


9) 



FLIGHT PHASE 
PRE LAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 

1/1 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: OVERPRESSURIZATION, TEMPERATURE, FATIGUE 

EFFECTS/RATIONALE : 

RUPTURE COULD CAUSE DEPLETION OF 02 AND POSSIBLY OTHER 
EXPLOSIONS. SHRAPNEL MAY PUNCTURE OTHER SYSTEMS, OR EXTERIOR OF 
ORBITER. THIS IS DETECTABLE THROUGH QUANTITY AND PRESSURE 
SENSORS . 


REFERENCES : 


REPORT DATE 12/03/86 


C-133 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

332 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEMS 

FAILURE MODE: 


02 TANK SUBASSEMBLY (5) 
LOSS OF ANNULUS VACUUM 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

c [ P 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC2 8 2 -“00 63 -0X00 


CAUSES: HOLE IN OUTER TANK 

EFFECTS/RATIONALE : 

CONDUCTIVE AND CONVECTIVE HEAT TRANSFER COULD OCCUR WITHOUT A 
VACUUM, CAUSING THE REACTANT TO HEAT UP AND BE DEPLETED QUICKLY. 
FAILURE COULD BE CAUSED BY VACUUM IONIZATION PUMP AND VACUUM ION 
PUMP PRESSURE SENSOR ON GROUND. THIS IS DETECTABLE FROM 
TANK QUANTITY SENSOR AND CONSOLE QUANTITY CHARTS OVER PERIOD OF 
TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C-134 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 

EPG 

333 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


02 RELIEF PORT (1) 
RESTRICTED FLOW 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AOA: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/1R 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 40V45VP015 


CAUSES: BLOCKAGE , CONTAMINATION, DEBRIS 

EFFECTS/RATIONALE : 

THERE IS ONLY ONE 02 RELIEF PORT FOR FIVE 02 TANKS. IF BLOCKED, 
COULD NOT RELIEVE OVERPRESSURIZATION AND TANKS WOULD RUPTURE. 

THE CRITICALITY IS 3/1R IF SAME TANK’S HEATERS FAIL ON AND CHECK 
VALVE FAILS CLOSED. THIS CAN BE DETECTED BY LOOKING AT 
TANK PRESSURE GAUGES OVER A PERIOD OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 


C— 135 



( 

I: 

INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

r 

[ 


DATE; 

10/21/86 


HIGHEST CRITICALITY HDW/FUNC 

tv 

SUBSYSTEM; EPG 


FLIGHT: 2/1R 


MDAC 

ID: 334 


ABORT: 2/1R 

(•; 

ITEM; 

: 02 TANK 

RELIEF VALVE 

(5) RV010,RV020,RV410,RV460 

£ 

FAILURE MODE: FAILED 

OPEN (ALSO INTERNAL LEAKAGE) 

r 

LEAD 

ANALYST: S. GOTCH 

SUBSYS 

LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 



r 

1) 

EPG 



fc 

2) 

PRSD 




3) 

OXYGEN STORAGE 



f 

4) 

02 TANKS 



K 

5) 





6) 





7) 




K- 

8) 




P 

9) 







CRITICALITIES 

i': 

FLIGHT PHASE HDW/FUNC 

ABORT HDW/FUNC 

i . 


PRELAUNCH: 

3/3 

RTLS: 2/1R 



LIFTOFF: 

2/1R 

TAL: 2/1R 

f* 


ONORBIT: 

2/1R 

AO A: 2/1R 

i- 


DEORBIT: 

2/1R 

ATO: 2/1R 



LANDING/SAFING: 

3/3 


i 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] C [ P ] 



LOCATION; MID FUSELAGE 

PART NUMBER; MC284-0440-0401 


CAUSES; VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 
JAMMING, FATIGUE 

EFFECTS/RATIONALE ; 

EACH TANK RELIEF VALVE RELIEVES EXCESS PRESSURE BUILDUP IN THE 
TANKS ABOVE 1005 PSIG. IF VALVE IS FAILED OPEN, EARLY DEPLETION 
OF 02 CAN RESULT. THE CRITICALITY IS 2/1R BECAUSE IF SAME TANKS 
CHECK VALVE IS ALSO FAILED OPEN, COULD LOSE ALL 02. 

DETECTABLE FROM TANK QUANTITY AND PRESSURE SENSORS AND OVER A 
PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS.’ 


REFERENCES ; 


REPORT DATE 12/03/86 


C-136 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/21/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/1R 

MDAC ID: 335 ABORT: 3/1R 

ITEM: 02 TANK RELIEF VALVE (5) RV010, RV020,RV410,RV460 

FAILURE MODE: FAILED CLOSED 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 
LANDING/SAFING : 

3/1R 

3/1R 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c [ p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0401 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION. 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

POSSIBLE RUPTURE OF TANK IF PRESSURE CANNOT BE RELIEVED. THIS 
COULD CAUSE LOSS OF REACTANT AND ORBITER. THE CRITICALITY IS 
3/1R IF SAME TANKS HEATERS FAIL ON AND CHECK VALVE FAILS CLOSED. 


REFERENCES : 


REPORT DATE 12/03/86 


C-137 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/21/86 

EPG 

336 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 02 TANK RELIEF VALVE (5) RV010,RV020,RV410, RV460 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

1/1 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

1/1 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

1/1 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0440-0401 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 

EFFECTS/RATIONALE : 

EARLY DEPLETION OF 02 REACTANT, PLUS POSSIBLE EXPLOSION OR 
FREEZING DUE TO REACTANT LEAKING UNDER THE PAYLOAD BAY. A LEAK 
IS DETECTABLE OVER A PERIOD OF TIME FROM CONSOLE QUANTITY CHARTS. 


REFERENCES : 


REPORT DATE 12/04/86 BTK 


C“138 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

B2 (4 OR 3) 

FAILURE MODE: FAILED ON 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUBASSEMBLY 

6) 

7) 

8 ) 

9) 


10/21/86 

EPG 

337 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 3/1R 


02 TANK HEATER ELEMENT Al(5), A2 (5) , Bl(4 OR 3), 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

1/1 

AO A: 

3/1R 

DEORBIT: 

1/1 

ATO: 

3/1R 

LANDING/SAFING: 

1/1 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, MECHANICAL SHOCK, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

THE B HEATERS ARE NOT OPERATIONAL IN A 5 TANK CONFIGURATION, I.E. 
3 SETS FOR 5 TANKS. EACH ELEMENT IS 250 WATTS. EACH TANK HAS 2 
HEATER ASSEMBLIES, EACH WITH AN A AND B HEATER. FAILURE IS 
DETECTABLE FROM TEMPERATURE AND PRESSURE SENSORS. 

THIS IS CRITICALITY 3/1R BECAUSE RELIEF VALVES WOULD VENT 
RESULTANT EXCESSIVE PRESSURE IN TANK AND DEPLETE THE 02. RELIEF 
VALVE FLOW RATE AT FULL FLOW PRESSURE IS 164 LB/HR WHILE TANK 
QUANTITY IS 781 LB. TANK COULD ALSO RUPTURE 35 HOURS AFTER TANK 
RESIDUAL LEVEL IS REACHED, THUS 1/1. 


REFERENCES : 


REPORT DATE 12/03/86 


C-139 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/21/86 

EPG 

338 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 TANK HEATER ELEMENT Al(5), A2(5), Bl(4 OR 3), 

B2 (4 OR 3) 

FAILURE MODE: FAILS OFF 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 02 TANK SUBASSEMBLY 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

c C P 3 


LOCATION: MID FUSELAGE 

PART NUMBER: MC282-0063-0100 


CAUSES: VIBRATION, MECHANICAL SHOCK, ELECTRICAL FAILURE 

EFFECTS/RATIONALE : 

WHEN PRESSURE FALLS BELOW 100 PSI, TANK IS CONSIDERED LOST. THIS 
WILL ALLOW COMPLETION OF ALL ABORTS AND ASCENTS SINCE EFFECT 
WOULD NOT OCCUR UNTIL AFTER OMS-2. HOWEVER THE CRITICALITY IS 
3/1R IF A COMBINATION OF TANK RELIEF VALVES AND MANIFOLD RELIEF 
VALVES FAIL OPEN. THIS COULD BE DETECTED FROM TEMPERATURE, 
QUANTITY, AND PRESSURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-140 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/21/86 

EPG 

339 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 TANK HEATER CONTROLLER PRESSURE 

SENSOR/TRANSDUCER (4) 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0185-001 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

FULL OUTPUT WOULD CAUSE HEATERS TO REMAIN OFF IN AUTOMATIC MODE. 
PRESSURE WOULD HAVE TO DROP TO BELOW 10 0 PSI BEFORE TANK IS 
CONSIDERED LOST, WHICH WOULD HAPPEN AFTER OMS2. CREW COULD CHECK 
TANK PRESSURE AND TEMPERATURE SENSORS TO SOLVE PROBLEM. THIS 
IS CRITICALITY 3/1R AT LIFTOFF BECAUSE TANK RELIEF VALVES STUCK 
OPEN COULD CAUSE LOSS OF PRESSURE EARLY. DETECTABLE FROM TANK 
PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-141 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/21/86 

EPG 

340 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 3/1R 


ITEM: 02 TANK HEATER CONTROLLER PRESSURE 

SENSOR/TRANS DUCER ( 4 ) 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 
2} PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

1/1 

AO A: 

3/1R 

DEORBXT: 

1/1 

ATO: 

3/1R 

LANDING/SAFING: 

1/1 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ P ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449*°0185~001 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE HEATERS TO BE ON ALWAYS IN AUTOMATIC MODE 
AND RELIEF VALVE WOULD VENT 02 AND DEPLETE IT. RELIEF VALVE FLOW 
RATE AT FULL FLOW PRESSURE IS 164 LB/HR WHILE TANK QUANTITY IS 
781 LB. 

ALSO TANK COULD RUPTURE STARTING 35 HOURS AFTER TANK RESIDUAL 
LEVEL IS REACHED AND HEATERS STILL ON, THUS 1/1. THIS IS 
DETECTABLE FROM TANK PRESSURE AND TEMPERATURE SENSORS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-142 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/21/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 1/1 

MDAC ID: 341 ABORT: 3/1R 

ITEM: 02 TANK HEATER CONTROLLER PRESSURE 

SENSOR/TRANSDUCER (4) 

FAILURE MODE: OUT OF TOLERANCE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/1R 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

1/1 

AO A: 

3/1R 

DEORBIT: 

1/1 

ATO: 

3/1R 

LANDING/SAFING: 

1/1 


REDUNDANCY SCREENS: 

A [ 1 3 

B [ P 3 

c C p ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0185-001 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 

EFFECTS/RATIONALE : 

DEPENDS ON DEGREE OF BEING OUT OF TOLERANCE - WORST CASE IS UNION 
OF ZERO AND FULL OUTPUT. COULD CAUSE HEATERS TO OPERATE 
ERRATICALLY. DETECTABLE FROM TANK PRESSURE SENSOR. 

A TANK COULD RUPTURE STARTING 35 HOURS AFTER THE TANK RESIDUAL 
LEVEL IS REACHED AND ITS HEATERS ARE STILL ON, THUS 1/1. 


REFERENCES : 


REPORT DATE 12/03/86 


C-143 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 22/86 

EPG 

342 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK PRESSURE SENSOR (5) 

FAILURE MODE: FULL OUTPUT 


LEAD ANALYST: S. GOTCH 


SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 


ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 


RTLS : 

3/3 

LIFTOFF: 

3/3 


TAL: 

3/3 

ONORBIT: 

3/3 


AO A: 

3/3 

DEORBIT: 

3/3 


ATO: 

3/3 

LANDING/SAFING: 3/3 




REDUNDANCY SCREENS: 

A [NA ] 

B 

[NA ] 

C [NA ] 

LOCATION: MID FUSELAGE 




PART NUMBER: MC449 

-0105-0001 




CAUSES: VIBRATION, 

SHOCK, ELECTRICAL 

FAILURE, 

CONTAMINATION 

EFFECTS/RATIONALE : 





THESE PRESSURE SENSORS HAVE NO 

EFFECT 

ON OTHER 

COMPONENTS, THEY 

ONLY DRIVE GAUGES. 

FULL OUTPUT 

WOULD 

CAUSE CREW TO TURN OFF 


HEATERS. CREW WOULD CHECK RELIEF VALVE CRACK PRESSURE, AND 
QUANTITY AND TEMPERATURE SENSORS TO SEE IF 
PRESSURE READING WAS ACCURATE. 


REFERENCES : 


REPORT DATE 12/03/86 


C-144 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 22/86 

EPG 

343 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK PRESSURE SENSOR (5) 

FAILURE MODE: ZERO OUTPUT 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0105-0001 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 


EFFECTS/RATIONALE : 

ZERO OUTPUT WOULD CAUSE CREW TO TURN HEATERS ON. CREW WOULD 
CHECK TANK TEMPERATURE AND QUANTITY SENSORS TO SEE IF PRESSURE 
READING WAS ACCURATE. 


REFERENCES : 


REPORT DATE 12/03/86 


C-145 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 22/86 

EPG 

344 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 TANK PRESSURE SENSOR (5) 

FAILURE MODE: OUT OF TOLERANCE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN STORAGE 

4) 

02 TANKS 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC449-0105-0001 


CAUSES: VIBRATION, SHOCK, ELECTRICAL FAILURE, CONTAMINATION 


EFFECTS/RATIONALE : 

INACCURATE READING MAY CAUSE CREW TO WANT TO MANUALLY OPERATE 
HEATERS TO KEEP PRESSURE READING WITHIN TOLERANCE. CREW COULD 
USE TEMPERATURE AND QUANTITY SENSORS TO SEE IF PRESSURE READING 
IS ACCURATE. A SMALL ERROR WILL NOT CAUSE ANY PROBLEMS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-146 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/22/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/1R 

MDAC ID: 345 ABORT: 3/1R 

ITEM: 02 (PRE-FLIGHT) FILL AND VENT QD CAPS (9) 

FAILURE MODE: EXTERNAL LEAKAGE 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0160 


CAUSES: CONTAMINATION, WEARS OUT, CORROSION 

EFFECTS/RATIONALE : 

EACH TANK HAS ITS OWN VENT QD CAP AND FILL QD CAP, EXCEPT TANKS 4 
AND 5 WHICH SHARE A FILL QD CAP. THE QD'S THEMSELVES ARE A LEVEL 
OF REDUNDANCY TO STOP LEAKS. BOTH CAP AND QD HAVE TO LEAK FOR A 
TANK LEAK TO OCCUR. 

FAILURE OF CAP ALONE IS NOT DETECTABLE. 


REFERENCES : 


REPORT DATE 12/03/86 


C-147 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 22/86 

EPG 

346 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/1R 

3/1R 


ITEM: 02 (PRE-FLIGHT) FILL QUICK DISCONNECTS (4) AND 

VENT QD'S (5) 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN STORAGE 

4) 02 TANKS 

5) 

6 ) 

7) 

8) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0110 


CAUSES: CONTAMINATION, WEARS OUT, CORROSION 


t 

i- 




sr 






EFFECTS/RATIONALE : 

EACH TANK HAS ITS OWN FILL AND VENT QD'S, EXCEPT TANKS 4 AND 5 
SHARE 1 FILL QD. ALL QD’S ARE ALSO CAPPED FOR ADDITIONAL 
REDUNDANCY. BOTH CAP AND QD HAVE TO LEAK FOR A TANK LEAK TO 
OCCUR. 

ALSO FAILURE OF TANK CHECK VALVE OPEN OR MANIFOLD RELIEF VALVE 
FAILED OPEN COULD CAUSE LOSS OF ALL REACTANT. FAILURE OF QD 
ALONE IS NOT DETECTABLE. 


REFERENCES : 


i. 


REPORT DATE 12/03/86 


C-148 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 22/86 

EPG 

347 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 

VENT QD'S (5) 
FAILURE MODE: 


02 (PRE-FLIGHT) FILL QUICK DISCONNECTS (4) AND 
INABILITY TO MATE/DEMATE 
LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 
1) EPG 
PRSD 

OXYGEN STORAGE 
02 TANKS 


2) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
8 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 

REDUNDANCY SCREENS: 


LOCATION: MID FUSELAGE 

PART NUMBER: MC276-0010-0110 


CRITICALITIES 
HDW/FUNC ABORT 


HDW/FUNC 


3/3 

RTLS: 

3/3 

3/3 

TAL: 

3/3 

3/3 

AO A: 

3/3 

3/3 

ATO: 

3/3 

3/3 


A [NA ] 

B [NA ] 

C [NA ] 


CAUSES: CORROSION, BINDING, DEBRIS 

EFFECTS/RATIONALE : 

MISSION DELAYED IF CAN’T FILL TANKS OR RELEASE QD. ONLY 
PRELAUNCH PHASE IS AFFECTED. THE FILL QD ALSO FUNCTIONS AS A 
VERTICAL DRAIN AT PAD. 


REFERENCES : 


REPORT DATE 12/03/86 


C— 149 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

348 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 FUEL CELL REACTANT VALVE POSITION INDICATORS 

(3) V45X1150E, V45X1155E, V45X1160E 
FAILURE MODE: READS OPEN WHEN VALVE CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULES 

5) 


6) 


7) 


8) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/ SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA 3 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE'S POSITION. NORMALLY, ALL 
VALVES ARE OPEN. COULD VERIFY ACCURACY FROM FUEL CELL 
FLOWMETERS . 


REFERENCES : 


REPORT DATE 12/03/86 


C-150 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 11/04/86 

SUBSYSTEM: EPG 

MDAC ID: 349 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: 02 FUEL CELL REACTANT VALVE POSITION INDICATORS 

(3) V45X1150E, V45X1155E, V45X1160E 
FAILURE MODE: READS CLOSED WHEN VALVE OPEN 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1 ) 

EPG 

2) 

PRSD 

3 ) 

OXYGEN DISTRIBUTION 

4 ) 

02 VALVE MODULES 

5 ) 


6 ) 


7 ) 


8 ) 


9 ) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRE LAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

COULD VERIFY ACCURACY FROM FUEL CELL FLOWMETERS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-151 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

350 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: H2 FUEL CELL REACTANT VALVE POSITION INDICATORS 

(3) V45X2150E, V45X2155E, V45X2160E 
FAILURE MODE: READS OPEN WHEN VALVE CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULES 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/ SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE f S POSITION. NORMALLY, ALL 
VALVES ARE OPEN. COULD VERIFY ACCURACY FROM FUEL CELL 
FLOWMETERS . 


REFERENCES : 


REPORT DATE 12/03/86 


C“152 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

351 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: H2 FUEL CELL REACTANT VALVE POSITION INDICATORS 

(3) V45X2150E, V45X2155E, V45X2160E 
FAILURE MODE: READS CLOSED WHEN VALVE OPEN 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULES 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 

HDW/FUNC 
3/3 
3/3 
3/3 
3/3 


C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 


EFFECTS/RATIONALE : 

COULD VERIFY ACCURACY FROM FUEL CELL FLOWMETERS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-153 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

352 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: 02 ECLSS SYSTEM SUPPLY VALVE POSITION INDICATOR 

(2) V45X1080E, V45X1083E 

FAILURE MODE: READS OPEN WHEN VALVE CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1) 

EPG 

2) 

PRSD 

3) 

OXYGEN DISTRIBUTION 

4) 

02 VALVE MODULES 

5) 


6) 


7) 


3) 


9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA 3 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE’S POSITION. NORMALLY, ALL 
VALVES ARE OPEN. COULD VERIFY ACCURACY FROM FLOWMETERS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-154 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

353 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: 02 ECLSS SYSTEM SUPPLY VALVE POSITION INDICATOR 

(2) V45X1080E/ V45X1083E 

FAILURE MODE: READS CLOSED WHEN VALVE OPEN 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULES 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

COULD VERIFY ACCURACY FROM FLOWMETERS. 


REFERENCES : 


REPORT DATE 12/03/86 


C-155 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

354 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 MANIFOLD VALVE POSITION INDICATORS (2) 

V45X1141E, V45XX146E 

FAILURE MODE: READS OPEN WHEN VALVE CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 


1 ) 

EPG 

2) 

PRSD 

3 ) 

OXYGEN DISTRIBUTION 

4 ) 

02 VALVE MODULES 

5 ) 


6 ) 


7 ) 


8 ) 


9 ) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE'S POSITION. NORMALLY, ALL 
VALVES ARE OPEN. THE FAILURE CAN BE VERIFIED FROM FLOWMETER. 


REFERENCES : 



REPORT DATE 12/03/86 


C-156 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 11/04/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: EPG FLIGHT: 3/3 

MDAC ID: 355 ABORT: 3/3 

ITEM: 02 MANIFOLD VALVE POSITION INDICATORS (2) 

V45X1141E, V45X1146E 

FAILURE MODE: READS CLOSED WHEN VALVE OPEN 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULES 

5) 

6 ) 

7) 

8 ) 

9 ) 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: MID FUSELAGE 

PART NUMBER: 

CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE’S POSITION. THE FAILURE CAN 
BE VERIFIED FROM FLOWMETER. 


REFERENCES : 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRE LAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/3 



REPORT DATE 12/03/86 


C-157 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

356 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 MANIFOLD VALVE POSITION INDICATORS (2) 

V45X2141E, V45X2146E 

FAILURE MODE: READS OPEN WHEN VALVE CLOSED 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULES 

5) 

6 ) 

7 ) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE'S POSITION. NORMALLY, ALL 
VALVES ARE OPEN. THE FAILURE CAN BE VERIFIED FROM THE FLOWMETER. 


REFERENCES : 


REPORT DATE 12/03/86 


C“158 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11/04/86 

EPG 

357 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: 02 MANIFOLD VALVE POSITION INDICATORS (2) 

V45X2141E, V45X2146E 

FAILURE MODE: READS CLOSED WHEN VALVE OPEN 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) HYDROGEN DISTRIBUTION 

4) H2 VALVE MODULES 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: 


CAUSES: ELECTRICAL FAILURE, CORROSION, VIBRATION, SHOCK 

EFFECTS/RATIONALE : 

SENSOR IS USED TO TELL CREW OF VALVE’S POSITION. THE FAILURE CAN 
BE VERIFIED FROM THE FLOWMETER. 


REFERENCES : 


EPORT DATE 12/03/86 


C-159 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11 / 22/86 

EPG 

358 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 FILTER (5) FL010,FL020,FL410, FL460 

FAILURE MODE: RESTRICTED FLOW, CLOGGED 

LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) 02 DISTRIBUTION 

4) 02 RELIEF VALVE/FILTER PACKAGES 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/1R 

TAL: 

3/1R 

ONORBIT: 

3/1R 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 2 ] 

B C P ] 

c [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC286-0054-0001 


CAUSES: CONTAMINATION, DEBRIS, DAMAGED ELEMENT 

EFFECTS/RATIONALE : 

EACH H2 AND 02 CYRO TANK HAS A FILTER FOR ITS REACTANT POSITIONED 
AHEAD OF ITS CHECK VALVE. THE FILTER IS REPLACED EVERY 15 
FLIGHTS. IF FILTER CLOGS, REACTANTS ARE UNABLE TO GET TO FUEL 
CELLS, AND REACTANT IS DEPLETED OUT TANK RELIEF VALVE. 

THE FAILURE CAN BE DETECTED USING TANK PRESSURE SENSOR. 


REFERENCES : 


REPORT DATE 12/03/86 


C-160 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11 / 22/86 

EPG 

359 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: 02 CHECK VALVE (1) CV020 

FAILURE MODE: FAILS OPEN (INTERNAL LEAKAGE ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7 ) 

8 ) 
9) 


EPG 

PRSD 

OXYGEN DISTRIBUTION 
02 VALVE MODULE 2 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

2/1R 

TAL: 

2/1R 

ONORBIT: 

2/1R 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 1 ] 

B [ F ] 

C [ P ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

CV020 CHECKS FLOW INTO TANK 2. HIGHER PRESSURE DOWNSTREAM OF 
CHECK VALVE THAN UPSTREAM WOULD FORCE REACTANT INTO TANK LINE. 
LOWER PRESSURE IN TANK OR LEAK WOULD HAVE TO OCCUR IN ADDITION TO 
CHECK VALVE FAILURE. RESULT COULD BE LOWER CYRO FLOW TO FUEL 
CELLS AND POSSIBLE SHUTDOWN. FAILS SCREEN B BECAUSE NEED A TANK 
LEAK OR RELIEF VALVE FAILED OPEN TO NOTICE. THIS IS CRITICALITY 
2/1R BECAUSE COMBINED FAILURE OF TANK RELIEF VALVE OPEN COULD 
LOSE VEHICLE DUE TO REACTANT LOSS. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


11 / 22/86 

EPG 

360 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: 02 CHECK VALVE (1) CV020 

FAILURE MODE: FAILS CLOSED (RESTRICTED FLOW ALSO) 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 


BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 
HDW/FUNC ABORT 


3/1R 

3/1R 

3/1R 

3/1R 

3/1R 


RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 


REDUNDANCY SCREENS: A [ 1 ] B[P] C[P] 

LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


CAUSES: VIBRATION, MECHANICAL SHOCK, CORROSION, CONTAMINATION, 

JAMMING, FATIGUE 


EFFECTS/RATIONALE : 

REACTANT IS UNABLE TO LEAVE TANK. THIS DEPLETES H2 OUT THE 
RELIEF VALVE AND COULD CAUSE FUEL CELL SHUTDOWN. THIS IS 
DETECTABLE FROM TANK PRESSURE SENSOR. FAILURE OF RELIEF VALVE 
CLOSED ALSO COULD CAUSE TANK EXPLOSION, IF HEATER IS ON IN MANUAL 
MODE OR FAILED ON. 


REFERENCES : 


REPORT DATE 12/03/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


HDW/FUNC 

1/1 

1/1 


LEAD ANALYST: S. GOTCH SUBSYS LEAD: M. HIOTT 

BREAKDOWN HIERARCHY: 

1) EPG 

2) PRSD 

3) OXYGEN DISTRIBUTION 

4) 02 VALVE MODULE 2 

5) 

6 ) 

7) 

8 ) 

9 ) 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


C [NA ]• 


CAUSES: CORROSION, FATIGUE, VIBRATION, CONTAMINATION 

EFFECTS/RATIONALE : 

REACTANT LEAKAGE INTO AREA UNDER PAYLOAD BAY COULD CAUSE 
EXPLOSION OR FREEZE OTHER SYSTEMS. LEAK MAY RESULT IN LOW OR NO 
CRYO FLOW INTO FUEL CELLS. FAILURE IS DETECTABLE FROM TANK 
QUANTITY AND PRESSURE SENSORS AND MANIFOLD PRESSURE SENSORS 
OVER A PERIOD OF TIME. 


REFERENCES : 


REPORT DATE 12/03/86 C-163 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

1/1 

RTLS 

LIFTOFF: 

1/1 

TAL: 

ONORBIT: 

1/1 

AO A: 

DEORBIT: 

LANDING/SAFING: 

1/1. 

1/1 

ATO: 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 


LOCATION: MID FUSELAGE 

PART NUMBER: MC284-0428-0010 


DATE: 11/22/86 HIGHEST CRITICALITY 

SUBSYSTEM: EPG FLIGHT: 

MDAC ID: 361 ABORT: 

ITEM: 02 CHECK VALVE (1) CV020 

FAILURE MODE: EXTERNAL LEAKAGE 






APPENDIX D 

POTENTIAL CRITICAL ITEMS 


MDAC ID 

ITEM 

FAILURE MODE 

200 

H2 (pre-flight ) fill and 
vent QD ' s 

External leakage 

202 

H2 (pre-flight) fill and 
vent QD caps 

External leakage 

207 

H2 tank heater controller 
pressure sensor/transducer 

Zero output 

208 

H2 tank heater controller 
pressure sensor/transducer 

Out of tolerance 

209 

H2 tank heater elements A&B 

Fails on 

211 

H2 tank relief valve 

Fails open (also 
internal leakage) 

213 

H2 tank relief valve 

External leakage 

216 

H2 tank subassembly 

External leakage 

217 

H2 tank subassembly 

Rupture 

218 

H2 tank subassembly 

Loss of annulus 
vacuum 

228 

H2 lines, components and > 
fittings 

External leakage 

229 

H2 lines, components and 
fittings 

Restricted flow 

231 

H2 manifold 1 relief valve 
RV031 

Fails open (also 
internal leakage) 

233 

H2 manifold 1 relief valve 
RV0 31 

External leakage 

234 

H2 manifold 2 relief valve 
RV041 

Fails open (also 
internal leakage) 

236 

H2 manifold 2 relief valve 
RV041 

External leakage 

237 

H2 check valves - -CV031, 
CV041 

Fails open (also 
internal leakage) 

239 

H2 check valves - CV031, 
CV041 

External leakage 

240 

H2 check valve - CV030 

Fails open (also 
internal leakage) 

242 

H2 check valve - CV030 

External leakage 

243 

H2 check valve - CV040 

Fails open (also 
internal leakage) 

245 

H2 check valve - CV040 

External leakage 

246 

H2 horizontal drain QD 

External leakage 

248 

H2 horizontal drain cap 

External leakage 

254 

H2 manifold 1 solenoid 
crossover valve - CV031 

External leakage 

255 

H2 fuel cell l solenoid 
reactant supply valve LV033 

Fails open (also 
internal leakage) 

256 

H2 fuel cell 1 solenoid 
reactant supply valve LV033 

Fails closed 
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257 

H2 fuel cell 1 solenoid 
reactant supply valve LV033 

External leakage 

258 

H2 fuel cell 2 solenoid 
reactant supply valve LV043 

Fails open (also 
internal leakage 

259 

H2 fuel cell 2 solenoid 
reactant supply valve LV043 

Fails closed 

260 

H2 fuel cell 2 solenoid 
reactant supply valve LV043 

External leakage 

261 

H2 fuel cell 3 solenoid 
reactant supply valve LV044 

Fails open (also 
internal leakage 

262 

H2 fuel cell 3 solenoid 
reactant supply valve LV044 

Fails closed 

263 

H2 fuel cell 3 solenoid 
reactant supply valve LV044 

External leakage 

266 

H2 manifold 2 solenoid 
crossover valve - LV041 

External leakage 

267 

H2 solenoid GSE supply 
valve - LV045 

Fails open (also 
internal leakage) 

269 

H2 solenoid GSE supply 
valve - LV045 

External leakage 

270 

H2 fill GSE supply T-0 QD - 
PD035 

External leakage 

272 

02 check valve — CV010 

Fails open (also 
internal leakage) 

274 

02 check valve - CV010 

External leakage 

275 

02 solenoid GSE. supply 
valve - LV015 

Fails open (also 
internal leakage) 

277 

02 solenoid GSE supply 
valve - LV015 

External leakage 

278 

02 solenoid ECLSS system 1 
supply valve - LV012 

Fails open (also 
internal leakage) 

279 

02 solenoid ECLSS system 1 
supply valve - LV012 

Fails closed * 

280 

02 solenoid ECLSS system 1 
supply valve - LV012 

External leakage 

281 

02 solenoid ECLSS system 2 
supply valve - LV022 

Fails open ( also 
internal leakage) 

282 

02 solenoid ECLSS system 2 
supply valve - LV022 

Fails closed 

283 

02 solenoid ECLSS system 2 
supply valve - LV022 

External leakage 

284 

02 fill GSE supply T-0 
QD - PD015 

External leakage 

289 

02 fuel cell 1 solenoid 
reactant supply valve LV013 

Fails open (also 
internal leakage) 

290 

02 fuel cell 1 solenoid 
reactant supply valve LV013 

Fails closed 

291 

02 fuel cell 1 solenoid 
reactant supply valve LV013 

External leakage 

294 

02 manifold 1 solenoid 
crossover valve - LV011 

External leakage 

297 

02 manifold 2 solenoid 
crossover valve - LV021 

External leakage 
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298 

02 horizontal drain QD 

External leakage 

300 

02 horizontal drain cap 

External leakage 

301 

02 fuel cell 3 solenoid 
reactant supply valve LV024 

Fails open (also 
internal leakage) 

302 

02 fuel cell 3 solenoid 
reactant supply valve LV024 

Fails closed 

303 

02 fuel cell 3 solenoid 
reactant supply valve LV024 

External leakage 

304 

02 fuel cell 2 solenoid 
reactant supply valve LV023 

Fails open (also 
internal leakage) 

305 

02 fuel cell 2 solenoid 
reactant supply valve LV023 

Fails closed 

306 

02 fuel cell 2 solenoid 
reactant supply valve LV023 

External leakage 

307 

02 manifold 1 relief valve - 
RV011 

Fails open (also 
internal leakage) 

309 

02 manifold 1 relief valve - 
RV011 

External leakage 

310 

02 manifold 2 relief valve - 
RV021 

Fails open (also 
internal leakage) 

312 

02 manifold 2 relief valve - 
RV021 

External leakage 

313 

02 check valve - CV021 

Fails open ( also 
internal leakage) 

315 

02 check valve - CV021 

External leakage 

316 

02 lines, components and 
fittings . 

External leakage 

317 

02 lines, components and 
fittings 

Restricted flow 

330 

02 tank subassembly 

External leakage 

331 

02 tailk subassembly 

Rupture 

332 

02 tank subassembly 

Loss of annulus 
vacuum 

334 

02 tank relief valves 

Fails open (also 
internal leakage) 

336 

02 tank relief valves 

' External leakage 

337 

02 tank heater elements 
Al, A2, Bl, B2 

Fails on 

340 

02 tank heater controller 
pressure sensor/transducer 

Zero output 

341 

02 tank heater controller 
pressure sensor/transducer 

Out of tolerance 

345 

02 (pre- flight) fill and 
vent QD caps 

External leakage 

346 

02 (pre-flight) fill and 
vent QD ' s 

External leakage 

359 

02 check valve - CV020 

Fails open (also 
internal leakage) 

361 

02 check valve - CV020 

External leakage 
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